[go: up one dir, main page]

CN104270394B - The acl rule High speed load implementation method of blocking equipment - Google Patents

The acl rule High speed load implementation method of blocking equipment Download PDF

Info

Publication number
CN104270394B
CN104270394B CN201410578416.1A CN201410578416A CN104270394B CN 104270394 B CN104270394 B CN 104270394B CN 201410578416 A CN201410578416 A CN 201410578416A CN 104270394 B CN104270394 B CN 104270394B
Authority
CN
China
Prior art keywords
acl rule
processor
data transfer
packet
blocking equipment
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201410578416.1A
Other languages
Chinese (zh)
Other versions
CN104270394A (en
Inventor
马红兵
王乾
吴友庆
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nanjing Balance Network Technology Co Ltd
Original Assignee
Nanjing Balance Network Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nanjing Balance Network Technology Co Ltd filed Critical Nanjing Balance Network Technology Co Ltd
Priority to CN201410578416.1A priority Critical patent/CN104270394B/en
Publication of CN104270394A publication Critical patent/CN104270394A/en
Application granted granted Critical
Publication of CN104270394B publication Critical patent/CN104270394B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101Access control lists [ACL]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08Configuration management of networks or network elements
    • H04L41/0893Assignment of logical groups to network elements

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

A kind of acl rule High speed load implementation method of blocking equipment,The processing unit to acl rule in blocking equipment to the hardware loading of acl rule is set first,Processing unit in the described blocking equipment to the hardware loading of acl rule includes that the fabric plane for data transfer for setting in systems also has the processor on business board to be connected with the processor on master control borad,Processor on described master control borad also has the processor on business board to be also connected with the base plane for controlling for setting in systems,Not fast enough the problem of CPU software load mode speed of the prior art is efficiently avoid in conjunction with other step methods,Under conditions of the demand capacity of present network service causes that blocking equipment acl rule capacity has reached millions,Existing scheme (CPU software loading) speed far can not meet the demand capacity of existing network service,Thus the defect of the serious extension for constraining existing blocking equipment.

Description

The acl rule High speed load implementation method of blocking equipment
Technical field
The present invention relates to a kind of network interrupter technique field, and in particular to a kind of acl rule High speed load of blocking equipment Implementation method.
Background technology
Realize at present blocking equipment to the processing method of acl rule often by set in systems for controlling Base plane also have the processor on business board to be connected with the processor on master control borad, then on master control borad processor warp The processor for crossing for the base plane for controlling to manipulate on business board is added acl rule with this to realize block function.
But existing this blocking equipment to the processing method of acl rule because be by point-to-point communication means, this The step of sample is just provided with transmission request data package and corresponding response data packet under communication connection patterns, thereby produces Communication delay, in former demand capacity in the case of million ranks, speed only needs to reach 10000/second, such existing Blocking equipment can substantially meet needs to the processing method of acl rule, but because the demand of present network service is held Under conditions of amount has reached millions, former speed far can not meet the demand capacity of existing network service, this The sample just serious extension for constraining existing blocking equipment.
The content of the invention
It is an object of the invention to provide a kind of acl rule High speed load implementation method of blocking equipment, set first and ACL is advised The processing unit to acl rule in the blocking equipment of hardware loading then, the blocking that the described hardware to acl rule is loaded Processing unit in equipment includes the setting fabric plane for data transfer in systems with the processor on master control borad Processor also on business board is connected, and the processor on described master control borad also has the processor on business board also with setting The base plane for control in systems is connected, and is passed for data for being provided with the fabric plane of data transfer Defeated module, is provided with the module for master control, the processor on described business board in the processor on described master control borad The Hash table of the module and storage acl rule for operation flow is inside provided with, is set in the described base plane for control The module for the configuration that communicates is equipped with, the processing unit in the blocking equipment that the described hardware to acl rule is loaded in addition is also With the communication interface that the processor on same master control borad is connected, the processor 4 on business board is with for data transfer The fabric plane interface for data transfer of fabric plane is connected;It is effectively prevented from conjunction with other step methods The demand capacity of present network service of the prior art causes that former speed is remote under conditions of having reached millions Far from the defect of the thus serious extension for constraining existing blocking equipment of the demand capacity for meeting existing network service.
In order to overcome deficiency of the prior art, the invention provides a kind of acl rule High speed load reality of blocking equipment The solution of existing method, it is specific as follows:
A kind of acl rule High speed load implementation method of blocking equipment, step is as follows:
Step 1:The processing unit to acl rule in blocking equipment to the hardware loading of acl rule, institute are set first Processing unit in the blocking equipment to the loading of the hardware of acl rule stated include being arranged in system 2 for data transfer Fabric plane 1 with the processor 3 on master control borad also have business board on processor 4 be connected, on described master control borad Processor 3 also has the processor 4 on business board to be also connected with the base plane 5 for controlling being arranged on machine frame 2, is used for The module 6 for data transfer is provided with the fabric plane 1 of data transfer, is set in the processor 3 on described master control borad The module 7 for master control is equipped with, the module 8 for operation flow and storage are provided with the processor 4 on described business board The Hash table 12 of acl rule, is provided with the module 9 for the configuration that communicates, in addition institute in the described base plane 5 for control Processing unit in the blocking equipment to the hardware loading of acl rule stated also is carried and is connected with the processor 3 on master control borad Communication interface 10, processor 4 on business board is with the fabric plane 1 that is used for data transfer for data transfer Fabric plane interface 11 is connected;
Step 2:When the blocking equipment for needing the hardware to acl rule described in use to load is to the processing unit of acl rule When carrying out the treatment to acl rule, in the blocking equipment first the setting to the loading of the hardware of acl rule to acl rule The communication interface 10 of processing unit be connected with external communication device;
Step 3:The place to acl rule in the blocking equipment that external communication device is loaded to the hardware to acl rule After managing the transmission packet of communication interface 10 of device, to the place to acl rule in the blocking equipment of the hardware loading of acl rule The communication interface 10 of reason device forwards a packet to the data in the processor 3 on master control borad, and then the processor 3 on master control borad is transported Row parses the packet for receiving for the module 7 of master control, and valid data in the packet are obtained after parsing simultaneously The valid data are packaged, described valid data include source IP address, purpose IP address, source port, destination interface, association View number and forwarding port, obtained after encapsulation comprising source IP address, purpose IP address, source port, destination interface, protocol number with And the packet of forwarding port, it is additionally provided with the packet for obtaining after packaging for data transfer to fabric plane 1 Unique mark;
Step 4:Then the processor 3 on master control borad runs the module 7 for master control come the packet obtained after encapsulation The fabric plane 1 for data transfer is transmitted to, the fabric plane 1 for data transfer is used for data transfer by operation Module 6 packet obtained after encapsulation is sent on business board by for the fabric plane interface of data transfer In processor 4, the number that the processor 4 on business board is obtained after running the encapsulation described in the module 8 pairs for operation flow Carry out parsing unique mark, source IP address, purpose IP address, the source obtained for data transfer to fabric plane 1 according to bag Mouth, destination interface, protocol number and forwarding port;
Step 5:The module 8 of operation flow is then used in first being obtained after parsing for data transfer to fabric plane 1 unique mark is compared with the correct unique mark for data transfer to fabric plane 1, if obtained after parsing Unique mark for data transfer to fabric plane 1 is directed to data transfer to unique mark of fabric plane 1 with correct Sensible consistent, the module 8 for operation flow is processed with regard to being directed to the packet obtained after described encapsulation, and described is directed to The method that the packet obtained after described encapsulation is processed is the module 8 for operation flow being obtained after described encapsulation Packet be directly stored in storage acl rule Hash table 12.
The described fabric plane interface for data transfer is Ethernet interface.
The described base plane 5 for control can be used as the mechanism of other Control on Communication.
The described module 7 for master control can obtain the data the packet for receiving is parsed after parsing Valid data in bag are simultaneously packaged the valid data;The packet obtained after encapsulation can be transmitted to and be passed for data Defeated fabric plane 1.
The described module 6 for data transfer can be the packet obtained after encapsulation by for data transfer Fabric plane interface is sent in the processor 4 on business board.
Described operation to the packet obtained after described encapsulation can parse for the module 8 of operation flow To unique mark, source IP address, purpose IP address, source port, destination interface, association for data transfer to fabric plane 1 View number and forwarding port;First the unique mark for data transfer to fabric plane 1 obtained after parsing with correct Compared to the unique mark of fabric plane 1 for data transfer, if what is obtained after parsing arrives for data transfer The unique mark of fabric plane 1 is consistent with the correct unique mark for data transfer to fabric plane 1, for industry With regard to being processed for the packet obtained after described encapsulation, described obtains the module 8 of flow of being engaged in for after described encapsulation To the method that is processed of packet be that the packet obtained after described encapsulation is directly deposited for the module 8 of operation flow It is put into the Hash table 12 of storage acl rule.
The present invention compared with prior art, loading velocity reach more than 150000/second (prior art be 10000/second Left and right), can cause that the rule capacity of blocking equipment millions is added in a short time, real-time blocking effect is reached, it is full Sufficient network Development demand, so as to be greatly expanded the range of application of the blocking equipment to the hardware loading of acl rule.
Brief description of the drawings
Fig. 1 is principle of device schematic diagram of the invention.
Specific embodiment
Hardware loading of the present invention refers to be realized by the method for hardware self study (hardware_learning) Interpolation data to depositing the Hash table of acl rule.
The content of the invention is described further below in conjunction with the accompanying drawings:
Shown in reference picture 1, the acl rule High speed load implementation method of blocking equipment, step is as follows:
Step 1:The processing unit to acl rule in blocking equipment to the hardware loading of acl rule, institute are set first Processing unit in the blocking equipment to the loading of the hardware of acl rule stated include being arranged in system 2 for data transfer Fabric plane 1 with the processor 3 on master control borad also have business board on processor 4 be connected, on described master control borad Processor 3 also has the processor 4 on business board to be also connected with the base plane 5 for controlling being arranged in system 2, is used for The module 6 for data transfer is provided with the fabric plane 1 of data transfer, is set in the processor 3 on described master control borad The module 7 for master control is equipped with, the module 8 for operation flow and storage are provided with the processor 4 on described business board The Hash table 12 of acl rule, is provided with the module 9 for the configuration that communicates, in addition institute in the described base plane 5 for control Processing unit in the blocking equipment to the hardware loading of acl rule stated also is carried and is connected with the processor 3 on master control borad Communication interface 10, processor 4 on business board is with the fabric plane 1 that is used for data transfer for data transfer Fabric plane interface 11 is connected;
Step 2:When the blocking equipment for needing the hardware to acl rule described in use to load is to the processing unit of acl rule When carrying out the treatment to acl rule, in the blocking equipment first the setting to the loading of the hardware of acl rule to acl rule The communication interface 10 of processing unit be connected with external communication device;
Step 3:The treatment to acl rule in blocking equipment of the external communication device to the hardware loading of acl rule After the communication interface 10 of device sends packet, to the treatment to acl rule in the blocking equipment of the hardware loading of acl rule The communication interface 10 of device forwards a packet to the data in the processor 3 on master control borad, and then the processor 3 on master control borad runs The packet for receiving is parsed for the module 7 of master control, the valid data and handle in the packet are obtained after parsing The valid data are packaged, and described valid data include source IP address, purpose IP address, source port, destination interface, agreement Number and forwarding port, obtained after encapsulation comprising source IP address, purpose IP address, source port, destination interface, protocol number and Forward port packet, be additionally provided with the packet for obtaining after packaging for data transfer to fabric plane 1 only One mark, the described unique mark for data transfer to fabric plane 1 that has includes the source of the packet obtained after encapsulation Mac addresses, purpose mac addresses, the protocol number for 0x8888, action identification and number, described action identification by 0x01 or 0x00 is constituted, and 0x01 represents addition operation, and 0x00 represents deletion action, such for data transfer to fabric plane 1 Unique mark there is identifiability;
Step 4:Then the processor 3 on master control borad runs the module 7 for master control come the packet obtained after encapsulation The fabric plane 1 for data transfer is transmitted to, the fabric plane 1 for data transfer is used for data transfer by operation Module 6 packet obtained after encapsulation is sent on business board by for the fabric plane interface of data transfer In processor 4, which offers a saving the transmission request data package under communication connection patterns of the prior art and corresponding sound The step of answering packet, and data are directly directly transmitted by hardware circuit, and the demand capacity of network service can be reached The speed requirement under conditions of millions is reached, the processor 4 on business board is used for the mould of operation flow by operation The packet obtained after encapsulation described in block 8 pairs parse obtain unique mark for data transfer to fabric plane 1, Source IP address, purpose IP address, source port, destination interface, protocol number and forwarding port;
Step 5:The module 8 of operation flow is then used in first being obtained after parsing for data transfer to fabric plane 1 unique mark is compared with the correct unique mark for data transfer to fabric plane 1, if obtained after parsing Unique mark for data transfer to fabric plane 1 is directed to data transfer to unique mark of fabric plane 1 with correct Sensible consistent, the module 8 for operation flow is processed with regard to being directed to the packet obtained after described encapsulation, and described is directed to The method that the packet obtained after described encapsulation is processed is the module 8 for operation flow being obtained after described encapsulation Packet be directly stored in storage acl rule Hash table 12, this direct location mode avoid in the past using drive journey Sequence come be stored in storage acl rule Hash table 12 in inefficiency shortcoming.
The described fabric plane interface for data transfer is Ethernet interface.
The described base plane 5 for control can improve compatibility as the mechanism of other Control on Communication.
Circuit board as network processes of the invention and the circuit board for light protection are realized interconnecting entirely by back card/back board. Each module meets ATCA carrier class standards, in the industry the veneer of each producer can interfix, with power module, control and interchange mode The warm standby function of block, the acl rule High speed load of the blocking equipment being suitable in highly reliable, Large Copacity the network of construction is realized Method;.
The above, is only presently preferred embodiments of the present invention, and any formal limitation is not made to the present invention, though So the present invention is disclosed above with preferred embodiment, but is not limited to the present invention, any to be familiar with this professional technology people Member, without departing from the scope of the present invention, when making a little change or modification using the technology contents of the disclosure above Be the Equivalent embodiments of equivalent variations, as long as be without departing from technical solution of the present invention content, according to technical spirit of the invention, Within the spirit and principles in the present invention, any simple modification, equivalent and improvement for being made to above example etc., still Belong within the protection domain of technical solution of the present invention.

Claims (3)

1. the acl rule High speed load implementation method of a kind of blocking equipment, it is characterised in that step is as follows:
Step 1:The processing unit to acl rule in blocking equipment to the hardware loading of acl rule is set first, to ACL The Fabric for data transfer that processing unit in the blocking equipment of the hardware loading of rule includes setting in systems puts down Face also has the processor on business board to be connected with the processor on master control borad, and the processor on described master control borad also has business Processor on plate is also connected with the base plane for controlling for setting in systems, and the Fabric for data transfer puts down The module for data transfer is provided with face, the CPU module for master control is provided with the processor on described master control borad, The Hash table of the module and storage acl rule for operation flow is provided with processor on described business board, it is described For being provided with the module for the configuration that communicates in the base plane of control, the blocking to the hardware loading of acl rule in addition sets Processing unit in standby also carries the communication interface being connected with the processor on master control borad, and the processor on business board is same to be used for The fabric plane interface for data transfer of the fabric plane of data transfer is connected;
Step 2:When the blocking equipment for needing to be loaded with the hardware to acl rule carries out advising ACL to the processing unit of acl rule During treatment then, the processing unit to acl rule in blocking equipment first the setting to the hardware loading of acl rule Communication interface is connected with external communication device;
Step 3:When the treatment to acl rule in the blocking equipment that external communication device is loaded to the hardware to acl rule is filled After the communication interface put sends packet, to the processing unit to acl rule in the blocking equipment of the hardware loading of acl rule Communication interface the data forward a packet to the processor on master control borad, then the processor on master control borad is run for master control Module the packet for receiving parsed, valid data in the packet are obtained after parsing and the valid data It is packaged, described valid data include source IP address, purpose IP address, source port, destination interface, protocol number and forwarding Port, obtains comprising source IP address, purpose IP address, source port, destination interface, protocol number and forwarding port after encapsulation Packet, is additionally provided with the unique mark to fabric plane for data transfer in the packet for obtaining after packaging;
Step 4:Then the processor on master control borad runs the module for master control to be transmitted to the packet obtained after encapsulation For the fabric plane of data transfer, for data transfer fabric plane by operation for data transfer module come The packet obtained after encapsulation is sent in the processor on business board by the fabric plane interface for data transfer, The packet that processor on business board is obtained after operation is used for the module of operation flow to described encapsulation is parsed Obtain unique mark, source IP address, purpose IP address, source port, destination interface, association to fabric plane for data transfer View number and forwarding port;
Step 5:Be then used in the module of operation flow first obtained after parsing for data transfer to fabric plane only One mark compared with the correct unique mark for data transfer to fabric plane, if obtained after parsing for number It is consistent with the correct unique mark for data transfer to fabric plane according to the unique mark for being transferred to fabric plane, For operation flow module with regard to being processed for the packet obtained after described encapsulation, it is described for described encapsulation The method that the packet for obtaining afterwards is processed is for the module of operation flow that the packet obtained after described encapsulation is straight Connect the Hash table for being stored in storage acl rule.
2. the acl rule High speed load implementation method of blocking equipment according to claim 1, it is characterised in that described use In data transfer fabric plane interface be Ethernet interface.
3. the acl rule High speed load implementation method of blocking equipment according to claim 1, it is characterised in that described use Can be used as the mechanism of other Control on Communication in the base plane of control.
CN201410578416.1A 2014-10-24 2014-10-24 The acl rule High speed load implementation method of blocking equipment Active CN104270394B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201410578416.1A CN104270394B (en) 2014-10-24 2014-10-24 The acl rule High speed load implementation method of blocking equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201410578416.1A CN104270394B (en) 2014-10-24 2014-10-24 The acl rule High speed load implementation method of blocking equipment

Publications (2)

Publication Number Publication Date
CN104270394A CN104270394A (en) 2015-01-07
CN104270394B true CN104270394B (en) 2017-06-23

Family

ID=52161884

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201410578416.1A Active CN104270394B (en) 2014-10-24 2014-10-24 The acl rule High speed load implementation method of blocking equipment

Country Status (1)

Country Link
CN (1) CN104270394B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105490888B (en) * 2016-01-26 2018-08-24 南京贝伦思网络科技股份有限公司 More back-end servers are carried out with the device and method of real time load detection by fabric plane

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7953885B1 (en) * 2003-04-18 2011-05-31 Cisco Technology, Inc. Method and apparatus to apply aggregate access control list/quality of service features using a redirect cause
CN102724119A (en) * 2012-06-08 2012-10-10 南京贝伦思网络科技有限公司 Rule synchronizing method for network load balancing device or network load distribution device
CN103188231A (en) * 2011-12-30 2013-07-03 北京锐安科技有限公司 Multi-core printed circuit board access control list (ACL) rule matching method
CN103797774A (en) * 2013-11-05 2014-05-14 华为技术有限公司 A network address translation device and method
CN103812768A (en) * 2014-01-26 2014-05-21 蓝盾信息安全技术股份有限公司 High-performance network data processing platform system
CN104092678A (en) * 2014-07-02 2014-10-08 杭州华三通信技术有限公司 Configuration method and device for access control lists

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7953885B1 (en) * 2003-04-18 2011-05-31 Cisco Technology, Inc. Method and apparatus to apply aggregate access control list/quality of service features using a redirect cause
CN103188231A (en) * 2011-12-30 2013-07-03 北京锐安科技有限公司 Multi-core printed circuit board access control list (ACL) rule matching method
CN102724119A (en) * 2012-06-08 2012-10-10 南京贝伦思网络科技有限公司 Rule synchronizing method for network load balancing device or network load distribution device
CN103797774A (en) * 2013-11-05 2014-05-14 华为技术有限公司 A network address translation device and method
CN103812768A (en) * 2014-01-26 2014-05-21 蓝盾信息安全技术股份有限公司 High-performance network data processing platform system
CN104092678A (en) * 2014-07-02 2014-10-08 杭州华三通信技术有限公司 Configuration method and device for access control lists

Also Published As

Publication number Publication date
CN104270394A (en) 2015-01-07

Similar Documents

Publication Publication Date Title
US11929945B2 (en) Managing network traffic in virtual switches based on logical port identifiers
US10205657B2 (en) Packet forwarding in data center network
EP3499815B1 (en) Packet transmission
US8693343B2 (en) Relay apparatus, virtual machine system, and relay method
CN106603550B (en) A kind of Network Isolation method and device
CN106685826B (en) Switchboard stacked system, from equipment, exchange chip and processing protocol message method
WO2018125518A3 (en) Computer program product, system, and method to allow a host and a storage device to communicate using different fabric, transport, and direct memory access protocols
US20180210750A1 (en) Virtual network management
CN107332772B (en) Forwarding table item establishing method and device
WO2015074182A1 (en) Table items addressing method, switch, and controller based on flow table
CN102158421A (en) Method and unit for creating layer three interface
CN103595712B (en) A kind of Web authentication method, apparatus and system
CN103346950B (en) Between a kind of rack wireless controller customer service plate, method and device are shared in load equally
CN104579973A (en) Message forwarding method and device of virtual cluster
EP3605960B1 (en) Mac address synchronization
CN107733765B (en) Mapping method, system and related equipment
CN104270394B (en) The acl rule High speed load implementation method of blocking equipment
CN105812221A (en) Data transmission device and method in virtual extensible local area network
CN104270396B (en) The high speed of many board acl rules of blocking equipment concurrently loads implementation method
CN103200110B (en) A kind of data multicast method and apparatus being applied to intelligent substation local area network
WO2014117474A1 (en) Routing method, system, and related device
CN104580367B (en) A kind of network data synchronizing method and system based on reactor patterns
CN104219240B (en) A kind of main frame learning method and device
CN102868642A (en) Method and device for achieving NVGRE message transmission in application specific integrated circuit (ASIC)
WO2016197933A2 (en) Packet forwarding

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
CB02 Change of applicant information

Address after: 210017, No. 308, 780 Main Street, Jianye District, Jiangsu, Nanjing (3)

Applicant after: NANJING BALANCE NETWORK TECHNOLOGY CO., LTD.

Address before: 210017, No. 308, 780 Main Street, Jianye District, Jiangsu, Nanjing (3)

Applicant before: Nanjing Balance Network Technology Co.,Ltd.

COR Change of bibliographic data
GR01 Patent grant
GR01 Patent grant