CN107241208B - A message forwarding method, first switch and related system - Google Patents

Abstract

The embodiment of the present application discloses a packet forwarding method, a first switch and a related system. The method includes: the first switch receives a plurality of packets from the first network, and the first switch respectively forwards the packets to the first firewall and the second firewall. The firewall sends multiple packets, and the packets sent by the first switch to the first firewall and the second firewall are the same, so that both the first firewall and the second firewall establish a session header according to the session header in the multiple packets. The session entry of the session to which the packet belongs. The session entry contains a quintuple, and the quintuple is used to determine whether the packet flowing through the firewall belongs to the session; the first switch receives the session from the second network sent by the first firewall. packet; the first switch forwards the packet from the session of the second network to the first network. With the present application, the second firewall can take over the service of the first firewall based on the session entry established by itself when the first firewall fails, thereby avoiding service interruption.

Description

A message forwarding method, first switch and related system

technical field

The present invention relates to the technical field of computers, and in particular, to a message forwarding method, a first switch and a related system.

Background technique

The principle of virtualization technology in environments such as virtual machine software (Virtual Machine ware, VMware), kernel virtual machine (Kernel-based Virtual Machine, KVM) is to virtualize the physical resources of a physical machine into multiple virtual machines (Virtual Machine, VM). ), so that each VM can implement the functions of a physical machine. With the continuous evolution of Network Function Virtualization (NFV), many traditional gateways, such as firewalls and routers, will be deployed on virtual machines. The mutual backup disaster recovery mechanism between multiple virtual machines can avoid the interruption of services carried by network traffic during the operation of the gateway.

Please refer to FIG. 1. FIG. 1 is a schematic diagram of a firewall based on virtualization technology in the prior art, that is, a virtual firewall, and a scenario of forwarding packets. There are other virtual firewalls, and FIG. 1 only takes two virtual firewalls as an example for illustration. The virtual firewall 101 and the virtual firewall 102 form a backup group 100 through the virtual router redundancy protocol (Virtual Router Redundancy Protocol, VRRP). The virtual firewalls other than the primary virtual firewall are backup virtual firewalls. The main firewall performs packet filtering or policy matching on packets based on session entries. When the primary virtual firewall fails, the backup group 100 will re-elect a virtual firewall as the new primary virtual firewall. When the switches 103 and 104 send packets to the backup group 100, only the primary virtual firewall will receive and forward them. the message.

The disadvantage of the prior art is that the firewall usually performs packet filtering or policy matching on packets based on session entries. Therefore, the current active virtual firewall needs to periodically back up the session entries on the current active virtual firewall to the current standby virtual firewall to ensure that the standby virtual firewall can take over the session based on the backed up session entries when the active virtual firewall fails. Business on the main virtual firewall. If the session entry is not backed up in time, some services will be interrupted.

SUMMARY OF THE INVENTION

The embodiment of the present invention discloses a service forwarding method, a first switch and a related system, which can solve the problem of service interruption caused by failure to backup session entries in time.

In a first aspect, an embodiment of the present invention provides a service forwarding method, which includes:

The first switch receives multiple packets from the first network, the first switch is connected to the first firewall, the second firewall, and the first network, and the multiple packets are the first network and the first network. For packets transmitted between two networks, the first firewall is the active firewall, the second firewall is the backup firewall, and the first firewall and the second firewall are respectively connected to the first switch and the second switch, the second switch is also connected to the second network;

The first switch sends the multiple packets to the first firewall and the second firewall respectively, and the packets sent by the first switch to the first firewall and the second firewall are the same , so that both the first firewall and the second firewall create a session entry of the session to which the session first packet belongs according to the session first packet in the multiple packets, and the session entry contains five group, and the five-tuple is used to judge whether the packet flowing through the firewall belongs to the session;

receiving, by the first switch, a packet from the session of the second network sent by the first firewall;

The first switch forwards the message of the session from the second network to the first network.

By performing the above steps, the first switch sends the same packet to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first packet in the packet. , the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the service on the first firewall based on the session entry established by itself, avoiding business interruption.

With reference to the first aspect, in a first possible implementation manner of the first aspect, after the first switch sends the multiple packets to the first firewall and the second firewall respectively, the method further include:

The first switch detects whether the first firewall is faulty, or whether the link between the first switch and the first firewall is interrupted;

If the first switch detects that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, the first switch receives and forwards the data sent by the second firewall. A message from the session of the second network.

With reference to the first possible implementation manner of the first aspect, in the second possible implementation manner of the first aspect, the first switch detects whether the first firewall is faulty, specifically:

The first switch detects whether the first firewall is faulty through a bidirectional forwarding detection mechanism BFD.

Specifically, the switch itself detects whether the first firewall is faulty, so as to adjust the packet forwarding policy in time when detecting the fault of the first firewall, thereby improving the performance of the switch.

With reference to the first possible implementation manner of the first aspect, or the second possible implementation manner of the first aspect, in the third possible implementation manner of the first aspect, the first switch detects that the third Before a firewall fails or the link between the first switch and the first firewall is interrupted, the method further includes:

The first switch does not receive the packets sent by the second firewall from the session of the second network, or receives and discards the packets sent by the second firewall from the second network. Session messages.

With reference to the third possible implementation manner of the first aspect, in a fourth possible implementation manner of the first aspect, the first switch includes a first interface connecting the first switch to the first firewall, and a second interface connecting the first switch to the second firewall,

Before the first switch detects that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, the first interface is set as the primary interface, and the second interface is set as the primary interface. is set as a standby interface; the first switch receives and forwards the packets from the session of the second network sent by the first firewall through the first interface, and the first switch does not receive all the message from the session of the second network sent by the second firewall, or the message from the session of the second network sent by the second firewall is received through the standby interface, and discarding the message from the session of the second network received through the standby interface;

After the first switch detects that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, the method further includes:

Set the first interface as a standby interface, set the second interface as a primary interface, and receive and forward the session data from the second network sent by the second firewall through the second interface. message.

In a second aspect, an embodiment of the present invention provides a first switch, where the first switch includes a network interface, a processor, and a memory, wherein:

The network interface is used for receiving messages and sending messages;

the memory is used to store instructions and data;

The processor, for reading the instructions and data stored in the memory, performs the following operations:

Receive multiple packets from the first network through the network interface, the first switch is connected to the first firewall, the second firewall and the first network, and the multiple packets are the first network For the packets transmitted between the first firewall and the second network, the first firewall is the active firewall, the second firewall is the backup firewall, and the first firewall and the second firewall are connected to the first switch and the second switch respectively. connected, the second switch is also connected to the second network;

The multiple packets are respectively sent to the first firewall and the second firewall through the network interface, and the packets sent to the first firewall and the second firewall through the network interface are the same , so that both the first firewall and the second firewall create a session entry of the session to which the session first packet belongs according to the session first packet in the multiple packets, and the session entry contains five group, and the five-tuple is used to judge whether the packet flowing through the firewall belongs to the session;

receiving, by using the network interface, the message of the session from the second network and sent by the first firewall;

The packet of the session from the second network is forwarded to the first network through the network interface.

By performing the above operations, the first switch sends the same packet to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first packet in the packet. , the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the service on the first firewall based on the session entry established by itself, avoiding business interruption.

With reference to the second aspect, in a first possible implementation manner of the second aspect, after the processor sends the multiple packets to the first firewall and the second firewall through the network interface, respectively, The processor is also used to:

Detecting whether the first firewall is faulty, or whether the link between the first switch and the first firewall is interrupted;

If the first firewall fails or the link between the first switch and the first firewall is interrupted, receiving and forwarding the data sent by the second firewall from the second network through the network interface and forwarding the message of the session.

With reference to the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, the processor detects whether the first firewall is faulty, specifically:

Whether the first firewall is faulty is detected through the bidirectional forwarding detection mechanism BFD.

Specifically, the switch itself detects whether the first firewall is faulty, so as to adjust the packet forwarding policy in time when detecting the fault of the first firewall, thereby improving the performance of the switch.

With reference to the first possible implementation manner of the second aspect, or the second possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, the processor detects that the first Before the firewall is faulty or the link between the first switch and the first firewall is interrupted, the processor is further configured to:

Do not receive packets from the session of the second network sent by the second firewall, or receive packets from the session of the second network sent by the second firewall through the network interface. packet, and discard the packet sent by the second firewall from the session of the second network.

With reference to the third possible implementation manner of the second aspect, in a fourth possible implementation manner of the second aspect, the network interface includes a first interface connecting the first switch to the first firewall, and a second interface connecting the first switch to the second firewall,

Before the processor detects that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, the first interface is set as the primary interface, and the second interface is set as the primary interface. Set as a standby interface; the first switch receives and forwards the packets from the session of the second network sent by the first firewall through the first interface, and the first switch does not receive the The packet sent by the second firewall from the session of the second network, or the packet sent by the second firewall from the session of the second network is received through the second interface, and discarding the packets from the session of the second network received through the second interface;

After detecting that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, the processor sets the first interface as a standby interface, and sets the second interface It is set as the main interface, and the packet from the session of the second network sent by the second firewall is received and forwarded through the second interface.

In a third aspect, an embodiment of the present invention provides a first switch, where the first switch includes a functional unit for executing part or all of the steps of any implementation manner of the first aspect of the embodiment of the present invention.

In a fourth aspect, an embodiment of the present invention provides a packet forwarding system, where the system includes a first switch, a second switch, a first firewall, and a second firewall, wherein the first switch is connected to the first firewall, the second firewall, and the second firewall. A firewall is connected to the first network, the first firewall is a primary firewall, the second firewall is a backup firewall, and the first firewall and the second firewall are respectively connected to the first switch and the second switch, The second switch is also connected to the second network, wherein:

a first switch, configured to receive multiple packets from the first network, where the multiple packets are packets transmitted between the first network and the second network; the second firewall sends the multiple packets, and the packets sent by the first switch to the first firewall and the second firewall are the same;

The first firewall and the second firewall are respectively configured to establish a session entry of the session to which the session header packet belongs according to the session header packet in the plurality of packets sent by the first switch, and the The session entry includes a quintuple, and the quintuple is used to determine whether the packet flowing through the firewall belongs to the session;

the first firewall, further configured to forward the message of the session from the second network to the first switch;

the first switch is further configured to receive a packet from the session of the second network sent by the first firewall;

The first switch is further configured to forward the packet of the session from the second network to the first network.

By running the system, the first switch sends the same packet to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first packet in the packet, so that , the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the service on the first firewall based on the session entry established by itself, avoiding business interruption.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the first switch includes a first interface connecting the first switch and the first firewall, and the first switch and all a second interface connected to the second firewall, the second firewall is further configured to forward the message of the session from the second network to the first switch;

The first switch is configured to detect whether the first firewall is faulty, or whether the link between the first switch and the first firewall is interrupted, and when detecting that the first firewall is faulty, or before the link between the first switch and the first firewall is interrupted, the first interface is set as the primary interface, and the second interface is set as the standby interface; after detecting that the first firewall is faulty, or After the link between the first switch and the first firewall is interrupted, the first interface is set as a standby interface, and the second interface is set as a primary interface;

Before detecting that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, receive the first firewall and the first firewall through the first interface and the second interface respectively. The second firewall sends the packet from the session of the second network, and discards the packet from the session of the second network received through the second interface;

After detecting that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, the second interface is used to respectively receive messages from the second firewall sent by the second firewall from the first firewall. The packets of the session of the second network are forwarded to the first network, and the packets of the session from the second network received through the second interface are forwarded.

With reference to the fourth aspect, in a second possible implementation manner of the fourth aspect, the second firewall is further configured to detect whether the second firewall is a backup firewall, and if the second firewall is a backup firewall, prohibiting The first switch forwards the packet from the session of the second network, and prohibits forwarding the packet from the session of the first network to the second switch.

By implementing the embodiment of the present invention, the first switch sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that First, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the service on the first firewall based on the session entry established by itself. , avoiding business interruption.

Description of drawings

In order to illustrate the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that are required in the description of the embodiments or the prior art.

Fig. 1 is the scene schematic diagram of the firewall forwarding service based on virtual technology in the prior art;

2 is a schematic flowchart of a service forwarding method provided by an embodiment of the present invention;

3 is a schematic diagram of a scenario of service forwarding provided by an embodiment of the present invention;

4 is a schematic diagram of a scenario of a logical link provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a first switch according to an embodiment of the present invention;

6 is a schematic structural diagram of another first switch provided by an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a message forwarding system according to an embodiment of the present invention.

Detailed ways

The technical solutions of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings of the embodiments of the present invention.

Please refer to FIG. 2. FIG. 2 is a schematic flowchart of a service forwarding method provided by an embodiment of the present invention. The method includes but is not limited to the following steps.

Step S201: The first switch receives multiple packets from the first network.

In order to better understand the solution of the embodiment of the present invention, an application scenario of the embodiment of the present invention is first introduced with reference to FIG. 3 . In FIG. 3, the first switch 311 is connected to the first firewall 312, the second firewall 313 and the first network, the second switch 314 is connected to the first firewall 312, the second firewall 313 and the second network, and the first firewall 312 is The primary firewall, the second firewall 313 is the backup firewall, the first switch 311 and the second switch 314 both know that the first firewall 311 is the primary firewall, and learn that the second firewall 314 is the backup firewall; in the first network There are one or more clients, and there are also one or more clients in the second network. No matter what packets are sent by the clients in the first network to the clients in the second network, the The message is sent to the first switch 311. The above "multiple messages" may be sent at the same time, or may be sent sequentially within a certain period of time. The "multiple" in the above "multiple messages" is intended to not Limits the type of packets to be sent. Correspondingly, the first switch 311 receives the message sent from the first network.

It should be noted that the first firewall 312 and the second firewall 313 in the embodiment of the present invention have the same address information externally, for example, have the same virtual network protocol (Internet Protocol, IP) address and virtual media access control ( Media Access Control (MAC) address, the source address of the packet sent by the first firewall 312 to the first switch 311 is the same as the source address of the packet sent by the second firewall 313 to the first switch 311. The source address of the packet sent by the firewall 312 to the second switch 314 is the same as the source address of the packet sent by the second firewall 313 to the second switch 314 . Optionally, the first firewall 312 and the second firewall 313 may be virtual firewalls or physical firewalls, and the first switch 311 and the second switch 314 may be virtual switches or physical switches.

In an optional solution, the first switch 311 includes a first interface 3111 and a second interface 3112, the second switch 314 includes a third interface 3141 and a fourth interface 3142, and the first switch 311 passes through the The first interface 3111 is connected to the first firewall 312 to form a first link 315 connecting the first switch 314 and the first firewall 312, and the first switch 311 is connected to the second firewall 313 through the second interface 3112 to form a first link 315. The second link 316 connecting the first switch 311 and the second firewall, the second switch 314 is connected with the first firewall 312 through the third interface 3141 to form a third link connecting the second switch 314 and the first firewall 312 The second switch 314 is connected to the second firewall 313 through the fourth interface 3142 to form a fourth link 318 connecting the second switch 314 and the second firewall 313 . As shown in FIG. 4 , the first link 315 and the second link 316 can be bundled together to form a logical link by means of link aggregation. The firewall in FIG. 4 actually refers to the first firewall 312 and the second firewall 313, not separately drawn separately. Similarly, the third link 317 and the fourth link 318 are bundled together to form a logical link by means of link aggregation, and the link aggregation can be manual link aggregation, or can be based on static link aggregation control Link Aggregation Protocol (LinkAggregation Control Protocol, LACP). Both the first switch 311 and the second switch 314 can be based on the preset master-standby relationship between the first firewall 312 and the second firewall 313, and detect the running status of the first firewall 312 and the second firewall 313, and then based on the master-standby relationship The first switch 311 and the second switch 314 can use the eth-trunk mechanism to switch the interface on the link to be used as the main interface, that is, the interface with higher priority, so that the reporting The message can be sent and received through the link corresponding to the main interface. In the following, for the sake of brevity of description, each device, interface, link, etc. will not be marked with numbers. For example, the first switch 311 is described as the first switch without the number 311 .

Step S202: The first switch sends the multiple packets to the first firewall and the second firewall respectively.

Specifically, after receiving the multiple packets, the first switch forwards the multiple packets to the first firewall and the second firewall respectively, and the multiple packets sent by the first switch to the first firewall and The multiple packets sent to the second firewall are the same. For example, the first switch implements sending the multiple packets to the first firewall and the second firewall by sending the multiple packets through the first interface and the second interface. The first switch can send the multiple packets to the first firewall and the second firewall at the same time, and can also send the packets in sequence. When the packets are sent in sequence, which one will be sent first and which will be sent later is not limited here. Preferably, the The first switch sends the multiple packets to the first firewall and the second firewall simultaneously.

Step S203: The first firewall and the second firewall receive the message sent by the first switch, determine whether there is a first message in the received messages, and if so, establish a session according to the first message.

Specifically, the first firewall and the second firewall each receive the message sent by the first switch, and each parses the received message to determine whether the received message includes the first message; This first message explains that before the client A in the first network communicates with the client B in the second network, a session needs to be established first. After the session is established, data can be transmitted based on the session. Client A and client B The establishment of a session needs to be achieved by sending the first packet, which is the SYN (full name: synchronous) packet during the three-way handshake process when establishing a TCP/IP connection. After a session is established between client A and client B, That is, a data packet can be sent based on the session to transmit data. After receiving the packet, the first firewall and the second firewall parse the packet to determine whether the received packet is a first packet or a data packet after session establishment.

When the first firewall determines that the received packet is the first packet, it obtains a quintuple included in the first packet, where the quintuple includes: source IP address, source port, destination IP address, destination port and protocol number , and then establish a session entry according to the quintuple, and the session entry contains the information of the above quintuple; similarly, when the second firewall determines that the received packet is the first packet, it also obtains the first packet and establishes session entries based on the quintuple; since the packets sent by the first switch to the first firewall and the second firewall are the same, as long as the first packet sent does not appear in the transmission process In the case of packet loss, the first firewall and the second firewall will establish the same session entry based on the same first packet received.

The “five-tuple” in the embodiment of the present invention is illustrated below. Assume that the IP address of the client A is 192.168.1.1, the user abc uses the port 20000 to initiate a TCP connection to the client B, and the file transfer protocol (FileTransfer Protocol, FTP) to download files from client B, the IP address of client B is 1.1.1.1, and the port number for providing services is 30000, then the information of the quintuple contained in the first packet sent by client A to client B is shown in the table 1 shown.

source IP address source port destination IP address destination port protocol 192.168.1.1 20000 1.1.1.1 30000 TCP

Table 1

The quintuple is used by the first firewall and the second firewall to determine whether the packets received subsequently are packets of the established session. If the included quintuple is the same as the quintuple in the established session, it indicates that the received packet belongs to the packet of the above session. It should be noted that although the source IP and destination IP addresses in Table 1 and Table 2 are exchanged, and the source port and destination port are exchanged, the quintuple shown in Table 2 is the same as the quintuple shown in Table 1. same group.

source IP address source port destination IP address destination port protocol 1.1.1.1 30000 192.168.1.1 20000 TCP

Table 2

In an optional solution, the first firewall and the second firewall can also establish a session based on a 7-tuple, and the 7-tuple has two additional factors of "application" and "user" on the basis of the quintuple, For example, the "application" is the above-mentioned FTP, and the "user" is the above-mentioned abc. It should be noted that when judging whether the packet is a packet of the established session, in addition to judging whether the packet contains the above-mentioned five-tuple or seven-tuple, it may also be necessary to judge whether the packet contains other factors. , the specific factors of other factors are not limited here.

Step S204: The first firewall forwards the received packet to the second switch.

Specifically, when the packet received by the first firewall includes the first packet, in addition to establishing a session based on the first packet, in an optional solution, the first firewall also judges itself Whether it is the standby firewall or the active firewall, if it is the active firewall, the first firewall forwards the first packet to the second switch. Since the first firewall is configured as the active firewall at the beginning, the first firewall The first packet will be forwarded to the second switch; in another optional solution, the first firewall does not determine whether it is the active firewall or the standby firewall, but directly forwards the received first packet to the second switch. After the first packet is finally sent to the client B through the second switch, a session between the client A and the client B is established.

Further, when the first firewall receives a data packet other than the first packet in the packet sent by the first switch, the first firewall determines whether the data packet is the session according to the established session entry. For the packet of the session corresponding to the entry, if the data packet is the packet of the session, in an optional solution, the first firewall, after learning that it is the active firewall, filters the packets corresponding to the session according to the The policy or forwarding policy processes the packet, for example, forwards the data packet to the second switch according to the policy corresponding to the session; in another optional solution, the first firewall directly forwards the received The data message is forwarded to the second switch.

The packet processing method of the second firewall is similar to that of the first firewall. When the packet received by the second firewall includes the first packet, in addition to establishing a session based on the first packet, in an optional solution, the second firewall also determines that it is a backup firewall. Or the active firewall, if it is a standby firewall, the second firewall will discard the first packet after receiving the first packet and establishing a session based on the first packet, because the second firewall is initially configured as a standby firewall firewall, so the second firewall will discard the first packet. In yet another optional solution, the second firewall does not determine whether it is the active firewall or the standby firewall, but directly forwards the received first packet to the second switch.

Further, when the second firewall receives a data message other than the first message in the message sent by the first switch, the second firewall determines whether the data message is the session table item according to the established session table entry. In an optional solution, the second firewall discards the data packet after learning that it is the standby firewall; In an optional solution, the second firewall directly forwards the received data packet to the second switch.

The following example illustrates how the first firewall and the second firewall determine whether they are the active firewall or the backup firewall: For example, when the first firewall and the second firewall are in the same backup group in the VRRP protocol, the first firewall and the second firewall are in the same backup group in the VRRP protocol. The second firewall can learn its own priority in the backup group through the VRRP protocol. If the priority of the first firewall is not the highest, it indicates that the first firewall belongs to the backup firewall in the backup group. The highest priority indicates that the first firewall belongs to the active firewall in the backup group; if the priority of the second firewall is not the highest, it indicates that the second firewall belongs to the backup firewall in the backup group. The second firewall with the highest priority indicates that the second firewall belongs to the active firewall in the backup group; the first firewall can also learn its own priority in other ways, for example, the first switch or the second switch A notification message is sent to the second firewall and the second firewall to inform which is the active firewall and which is the backup firewall.

Step S205: The second switch sends the packet from the second network to the first firewall.

Specifically, after the session between client A and client B is successfully established, client B can send the message of the session to client A through the second network, and when the sent message of the session is forwarded to the After the second switch, the second switch forwards the received packets to the first firewall and the second firewall, for example, forwards the packets of the session through the third interface and forwards the packets of the session through the fourth interface. Similarly, client A can send the message of the session to client B through the first network. After the sent message of the session is forwarded to the first switch, the first switch will send the received message Forwarding to the first firewall and the second firewall, for example, forwarding the packet of the session through the first interface and forwarding the packet of the session through the second interface.

Step S206: the first firewall receives and forwards the message of the session to the first switch.

Specifically, the first firewall receives the packet forwarded by the second switch. In an optional solution, the first firewall determines whether the packet contains the above session entry after learning that it is the active firewall. The five-tuple in the packet is forwarded to the first switch if it is included. In yet another optional solution, the first firewall does not need to confirm that it is the active firewall or the standby firewall, but directly determines whether the received packet contains the quintuple in the session entry. The packet is then forwarded to the first switch.

When the above-mentioned second switch sends the second firewall the same message as the message sent to the first firewall, in an optional solution, when the second firewall learns that it is the standby firewall, it discards the received message. In yet another optional solution, the second firewall receives the packet sent by the second switch without confirming whether it is the active firewall or the standby firewall, and directly determines whether the packet is in the packet. Whether the quintuple information in the established session table is included, if included, forward the received message to the first switch.

Step S207: the first switch receives the message sent by the first firewall.

Step S208: The first switch forwards the message sent by the first firewall to the first network.

Specifically, after receiving the packet sent by the first firewall, the first switch forwards the received packet to the first network. It should be noted that when the second firewall forwards the packet of the session to the first switch, the first switch does not receive the packet sent by the second firewall, or the first switch receives the packet sent by the second firewall. but discard the packets sent by the second firewall. For example, the first switch can set the first interface connected to the first firewall as the main interface, and set the second interface connected to the second firewall to As the standby interface, the first switch receives packets through the first interface and the second interface, but discards the packets received through the standby interface, or the first switch does not receive packets through the second interface as the standby interface at all message.

By performing steps S201-208, the first firewall and the second firewall establish a session entry for the same session according to the same first packet, and the first firewall forwards the session packet when the first firewall is not faulty. In the event of a failure, the session entry does not need to be backed up to the second firewall, and the session entry established by the second firewall itself can be used to take over the forwarding of the session's packets.

The following describes an implementation manner in which the second firewall acts as the new active firewall to take over the forwarding of the packet after the active/standby switchover occurs through steps S209 to S212.

Step S209: the second switch sends the message of the session to the second firewall.

Specifically, the second switch can detect whether the first firewall is faulty in real time or periodically; other devices can also detect whether the first firewall is faulty, and then notify the second switch of the detection result. The manner in which the second switch detects whether the first firewall is faulty may be specifically: detecting the link connected to the first firewall through a bidirectional forwarding detection (Bidirectional Forwarding Detection, BFD) mechanism, or the software of the device where the first firewall is located, Or whether the network card of the device where the first firewall is located is faulty; or it is judged whether the time for continuously not receiving the packets sent by the first firewall exceeds a preset time threshold, and exceeding the time threshold indicates a fault. Of course, other methods may also be used to detect whether the first firewall is faulty, and other methods are not listed here.

When detecting that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, the second switch takes the second firewall as the active firewall, and if the second switch receives the The packet from the second network, in an optional solution, the second switch sends the packet to the second firewall, and no longer sends the packet to the first firewall, for example, the second switch The fourth interface is set as the new primary interface, and the third interface is set as the standby interface, and then the packets are sent through the fourth interface as the new primary interface, and the packets are not sent through the third interface as the standby interface. In another optional solution, the second switch sends the packet to both the first firewall and the second firewall after resetting the primary interface and the backup interface. In yet another optional solution, the second switch sends the packet to the second firewall, and detects that the first firewall is faulty or the link between the first switch and the first firewall is interrupted. Whether it is back to normal, if it is back to normal, the next time the second switch receives a packet from the second network, it will send the received packet to the first firewall and the second firewall. Other options are not listed here.

Step S210: The second firewall receives and forwards the message of the session to the first switch.

Specifically, the second firewall receives the message sent by the second switch and judges whether there is a first message in the received message; when the message received by the second firewall includes the first message, the second firewall In addition to establishing a session based on the first packet, in an optional solution, the second firewall will also determine whether it is the standby firewall or the active firewall, and if it is the active firewall, the second firewall will use the first packet Forwarded to the first switch, since the first firewall has failed, the second firewall has been configured as the active firewall, so the second firewall will forward the first packet to the first switch. In yet another optional solution, the second firewall does not determine whether it is the active firewall or the standby firewall, but directly forwards the received first packet to the first switch.

Further, when the second firewall receives a data packet other than the first packet in the packet sent by the second switch, the second firewall determines whether the data packet is the session according to the established session entry. The packet of the session corresponding to the entry, if the data packet is the packet of the session, in an optional solution, the second firewall, after learning that it is the active firewall, forwards the data packet to The first switch; in another optional solution, the second firewall omits confirming itself as the active firewall or the standby firewall, but directly forwards the received data packet to the first switch.

It should be noted that, when the first firewall also receives the message sent by the second switch, and the message includes the first message, the first firewall will not only establish a session based on the first message, but also in a In an optional solution, the first firewall will also determine whether it is a backup firewall or an active firewall, and if it is a backup firewall, the first firewall will discard the first packet after receiving the first packet and establishing a session based on the first packet. first message. Since the first firewall is detected to be faulty in step S209, the first firewall is configured as a backup firewall instead of an active firewall, so the first firewall will discard the first packet. In yet another optional solution, the first firewall omits determining whether it is the active firewall or the standby firewall, and directly forwards the received first packet to the first switch.

Further, when the first firewall receives a data packet other than the first packet in the packet sent by the second switch, the first firewall determines whether the data packet is the session table entry according to the established session table entry. If the data packet is a packet of the session, in an optional solution, the first firewall discards the data packet after learning that it is the standby firewall; In an optional solution, the first firewall omits determining whether it is the active firewall or the standby firewall, and directly forwards the received data packet to the first switch.

Step S211: the first switch receives the message sent by the second firewall.

Step S212: The first switch forwards the message sent by the second firewall to the first network.

Specifically, the first switch can detect whether the first firewall is faulty in real time or periodically; other devices can also detect whether the first firewall is faulty, and then notify the first switch of the detection result. The manner in which the first switch detects whether the first firewall is faulty may be specifically: detecting the link connected to the first firewall through the BFD mechanism, or the software of the device where the first firewall is located, or the device where the first firewall is located Whether the network card of the first firewall is faulty; or determine whether the time for continuously not receiving the message sent by the first firewall exceeds a preset time threshold, and exceeding the time threshold indicates a fault. Of course, other methods may also be used to detect whether the first firewall is faulty, and other methods are not listed here.

If the first switch does not receive the message sent by the second firewall when the first firewall is not faulty and the link between the first firewall and the first switch is not interrupted, then it is detected that the first firewall is faulty Or when the link is interrupted, the second firewall is used as the active firewall, and the packet sent by the second firewall is received and forwarded to the first network.

If the first switch receives and discards the packet sent by the second firewall when the first firewall is not faulty and the link between the first firewall and the first switch is not interrupted, then the first firewall is detected when the first firewall is detected. When a fault occurs or the link is interrupted, the second firewall is used as the active firewall, and the packet sent by the second firewall is no longer discarded but the packet is forwarded to the first network.

For example, the first switch sets the second interface as a new primary interface and sets the first interface as a backup interface, the first switch can receive packets through the second interface that is the new primary interface, and sends packets through the second interface The received message is forwarded to the first network.

In the method described in FIG. 2, the first switch sends the same packet to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first packet in the packet In this way, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly replace the session entry on the first firewall based on the session entry established by itself. business and avoid business interruption.

The methods of the embodiments of the present invention are described in detail above. In order to facilitate better implementation of the above solutions of the embodiments of the present invention, correspondingly, the switches of the embodiments of the present invention are provided below.

Please refer to FIG. 5. FIG. 5 is a first switch 50 provided by an embodiment of the present invention. The first switch 50 includes a processor 501, a memory 502, and a network interface 503. The processor 501, the memory 502, and the network interface 503 connected to each other via a bus.

Memory 502 includes, but is not limited to, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), or portable read only memory (CD-ROM).

The processor 501 may be one or more central processing units (Central Processing Unit, CPU for short). In the case where the processor 501 is a CPU, the CPU may be a single-core CPU or a multi-core CPU.

The network interface 503 may be a wired interface, such as a fiber distributed data interface (Fiber Distributed Data Interface, FDDI for short), a Gigabit Ethernet (Gigabit Ethernet, GE for short) interface; the network interface 503 may also be a wireless interface.

The memory 502 is also used to store information such as session entries, related instructions and data.

After the processor 501 in the first switch 50 is configured to read the program code stored in the memory 502, the following operations are performed:

Receive multiple packets from the first network through the network interface 503, the first switch 50 is connected to the first firewall, the second firewall and the first network, the multiple packets are the first For packets transmitted between a network and a second network, the first firewall is the active firewall, the second firewall is the backup firewall, and the first firewall and the second firewall are connected to the first switch 50 and the second firewall, respectively. A second switch is connected, and the second switch is also connected to the second network;

The multiple packets are respectively sent to the first firewall and the second firewall through the network interface 503, and the packets sent to the first firewall and the second firewall through the network interface 503 are: The same, so that both the first firewall and the second firewall create a session entry of the session to which the session first packet belongs according to the session header in the multiple packets, and the session entry contains Five-tuple, the five-tuple is used to judge whether the packet flowing through the firewall belongs to the session;

receiving, through the network interface 503, the message from the session of the second network sent by the first firewall;

The packet of the session from the second network is forwarded to the first network through the network interface 503 .

By performing the above operations, the first switch 50 sends the same packet to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first packet in the packet, so that The second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the service on the first firewall based on the session entry established by itself. Business interruption is avoided.

In an optional solution, after the processor 501 sends the multiple packets to the first firewall and the second firewall respectively through the network interface 503, the processor 501 is further configured to :

Detecting whether the first firewall is faulty, or whether the link between the first switch 50 and the first firewall is interrupted;

If the first firewall fails, or the link between the first switch 50 and the first firewall is interrupted, the network interface 503 receives and forwards the data sent by the second firewall from the first firewall. Two network packets of the session.

In yet another optional solution, the processor 501 detects whether the first firewall is faulty, specifically: detecting whether the first firewall is faulty through a bidirectional forwarding detection mechanism BFD.

Specifically, the switch itself detects whether the first firewall is faulty, so as to adjust the packet forwarding policy in time when detecting the fault of the first firewall, thereby improving the performance of the switch.

In yet another optional solution, before the processor 501 detects that the first firewall is faulty or the link between the first switch 50 and the first firewall is interrupted, the processor 501 Also used for:

Do not receive the message of the session from the second network sent by the second firewall, or receive the session from the second network sent by the second firewall through the network interface 503 and discard the packets sent by the second firewall from the session of the second network.

In yet another optional solution, the network interface 503 includes a first interface connecting the first switch 50 to the first firewall, and a first interface connecting the first switch 50 to the second firewall. Two interface,

Before the processor 501 detects that the first firewall is faulty or the link between the first switch 50 and the first firewall is interrupted, the first interface is set as the main interface, and the second interface is set as the main interface. The interface is set as a standby interface; the first switch 50 receives and forwards the packets from the session of the second network sent by the first firewall through the first interface, and the first switch 50 Do not receive the message of the session from the second network sent by the second firewall, or receive the session from the second network sent by the second firewall through the second interface packets, and discard the packets from the session of the second network received through the second interface;

After the processor 501 detects that the first firewall is faulty or the link between the first switch 50 and the first firewall is interrupted, the processor 501 sets the first interface as a standby interface, and sets the first interface as a standby interface. The second interface is set as the main interface, and the packet from the session of the second network sent by the second firewall is received and forwarded through the second interface.

It should be noted that, the specific implementation of the switch 50 may also correspond to the corresponding description with reference to the method embodiment shown in FIG. 2 , which will not be repeated here.

By performing the above operations, the first switch 50 sends the same packet to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first packet in the packet, so that The second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the service on the first firewall based on the session entry established by itself. Business interruption is avoided.

Please refer to FIG. 6. FIG. 6 is a schematic structural diagram of another first switch 60 provided by an embodiment of the present invention. The first switch 60 may include a receiving unit 601 and a sending unit 602. The detailed description of the receiving unit 601 and the sending unit 602 as follows.

The receiving unit 601 is configured to receive multiple packets from the first network, the first switch 60 is connected to the first firewall, the second firewall and the first network, and the multiple packets are the first For the packets transmitted between the network and the second network, the first firewall is the main firewall, the second firewall is the backup firewall, and the first firewall and the second firewall are connected to the first switch 60 and the second firewall, respectively. Two switches are connected, and the second switch is also connected to the second network;

The sending unit 602 is configured to send the multiple packets to the first firewall and the second firewall respectively, and the packets sent by the first switch 60 to the first firewall and the second firewall are the same , so that both the first firewall and the second firewall create a session entry for the session to which the session first packet belongs according to the session header in the multiple packets, and the session entry includes five tuple, the quintuple is used to judge whether the packet flowing through the firewall belongs to the session;

The receiving unit 601 is further configured to receive the message from the session of the second network sent by the first firewall;

The sending unit 602 is further configured to forward the packet of the session from the second network to the first network.

By running the above unit, the first switch 60 sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that The second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the service on the first firewall based on the session entry established by itself. Business interruption is avoided.

In an optional solution, the first switch 60 further includes a detection unit, and the detection unit is configured to, after the sending unit 602 sends the multiple packets to the first firewall and the second firewall, respectively , to detect whether the first firewall is faulty, or whether the link between the first switch 60 and the first firewall is interrupted;

If the first switch 60 detects that the first firewall is faulty, or the link between the first switch 60 and the first firewall is interrupted, the receiving unit 601 is further configured to receive the data sent by the second firewall the message from the session of the second network, the sending unit 602 is further configured to forward the message from the session of the second network sent by the second firewall.

In another optional solution, the detection unit is specifically configured to detect whether the first firewall is faulty through a bidirectional forwarding detection mechanism BFD.

Specifically, the switch itself detects whether the first firewall is faulty, so as to adjust the packet forwarding policy in time when detecting the fault of the first firewall, thereby improving the performance of the switch.

In yet another optional solution, the first switch 60 further includes a discarding unit, and the detection unit detects that the first firewall is faulty, or the first switch 60 and the first firewall are between Before the link is interrupted, the receiving unit 601 is further configured to not receive packets from the session of the second network sent by the second firewall, or the receiving unit 601 is configured to receive packets sent by the second firewall For the packet from the session of the second network, the discarding unit is configured to discard the packet from the session of the second network that is received by the receiving unit 601 and sent by the second firewall.

In yet another optional solution, the first switch 60 includes a first interface connecting the first switch 60 with the first firewall, and a first interface connecting the first switch 60 with the second firewall the second interface,

Before the detection unit detects that the first firewall is faulty or the link between the first switch 60 and the first firewall is interrupted, the first interface is set as the main interface, and the second interface is set is a standby interface; the receiving unit 601 of the first switch 60 receives the packet from the session of the second network sent by the first firewall through the first interface, and the sending unit 602 forwards the receiving unit 601 through the first interface. The packet sent by the first firewall and sent by the first interface from the session of the second network, the receiving unit 601 of the first switch 60 does not receive the packet sent by the second firewall from the second firewall. The message of the session of the network, or the receiving unit 601 receives the message of the session from the second network sent by the second firewall through the standby interface, and the discarding unit discards the receiving unit 601 through the the message of the session from the second network received by the standby interface;

The first switch 60 further includes a configuration unit, and the configuration unit is configured to, after the detection unit detects that the first firewall is faulty or the link between the first switch 60 and the first firewall is interrupted, The first interface is set as the standby interface, the second interface is set as the primary interface, and the receiving unit 601 is further configured to receive the second interface through the second interface after the configuration unit sets the second interface as the primary interface The packet sent by the second firewall from the session of the second network, the sending unit 602 is further configured to forward the packet sent by the second firewall and received by the receiving unit 601 through the second interface from the second firewall. Two network reports of the session.

It should be noted that, the specific implementation of the switch 60 may also correspond to the corresponding description with reference to the method embodiment shown in FIG. 2 , which will not be repeated here.

By running the above unit, the first switch 60 sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that The second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the service on the first firewall based on the session entry established by itself. Business interruption is avoided.

The methods and switches of the embodiments of the present invention are described in detail above. In order to facilitate better implementation of the above solutions of the embodiments of the present invention, correspondingly, the systems of the embodiments of the present invention are provided below.

Please refer to FIG. 7. FIG. 7 is a message forwarding system 70 provided by an embodiment of the present invention. The file forwarding system 70 includes a first switch 701, a second switch 702, a first firewall 703, and a second firewall 704, wherein, The first switch 701 is connected to the first firewall 703, the second firewall 704 and the first network, the first firewall 703 is the main firewall, the second firewall 704 is the backup firewall, the first firewall 703 and the second firewall 704 are respectively connected with the first switch 701 and the second switch 702, and the second switch 702 is also connected with the second network, wherein:

The first switch 701 is configured to receive multiple packets from the first network, where the multiple packets are packets transmitted between the first network and the second network; respectively send the packets to the first firewall 703 Send the multiple packets with the second firewall 704, and the packets sent by the first switch 701 to the first firewall 703 and the second firewall 704 are the same;

The first firewall 703 and the second firewall 704 are respectively configured to establish a session table of the session to which the session header packet belongs according to the session header packet in the plurality of packets sent by the first switch 701 Item, the session table entry includes a quintuple, and the quintuple is used to judge whether the packet flowing through the firewall belongs to the session;

The first firewall 703 is further configured to forward the packets of the session from the second network to the first switch 701;

The first switch 701 is further configured to receive a packet from the session of the second network sent by the first firewall 703;

The first switch 701 is further configured to forward the packet of the session from the second network to the first network.

By running the message forwarding system 70, the first switch 701 sends the same message to the first firewall 703 and the second firewall 704, so that the first firewall 703 and the second firewall 704 establish a message based on the first message in the message. The same session entry, in this way, the second firewall 704 does not need to back up the session entry from the first firewall 703, and when the first firewall 703 fails, the second firewall 704 can directly The session entry takes over the service on the first firewall 703, avoiding service interruption.

In an optional solution,

The first switch 701 includes a first interface connecting the first switch 701 with the first firewall 703, and a second interface connecting the first switch 701 with the second firewall 704, the second The firewall 704 is further configured to forward the packet of the session from the second network to the first switch 701;

The first switch 701 is used to detect whether the first firewall 703 is faulty, or whether the link between the first switch 701 and the first firewall 703 is interrupted, and when detecting the first firewall 703 failure, or before the link between the first switch 701 and the first firewall 703 is interrupted, the first interface is set as the primary interface, and the second interface is set as the standby interface; After the first firewall 703 fails or the link between the first switch 701 and the first firewall 703 is interrupted, the first interface is set as a standby interface, and the second interface is set as a primary interface;

Before detecting that the first firewall 703 is faulty or the link between the first switch 701 and the first firewall 703 is interrupted, the first interface and the second interface respectively receive the first A firewall 703 and the second firewall 704 send packets from the session of the second network, and discard packets from the session of the second network received through the second interface arts;

After detecting that the first firewall 703 is faulty or the link between the first switch 701 and the first firewall 703 is interrupted, the second interface respectively receives from the second firewall 704 The packets of the session of the second network are forwarded to the first network, and the packets of the session of the second network received through the second interface are forwarded.

In another optional solution, the second firewall 704 is further configured to detect whether the second firewall 704 is a backup firewall, and if the second firewall 704 is a backup firewall, the forwarding to the first switch 701 is prohibited. For the packets of the session from the second network, forwarding of the packets from the session of the first network to the second switch 702 is prohibited.

Further, the specific implementation of the first switch 701 may also refer to the implementation of the first switch 50 in the embodiment shown in FIG. 5 and the implementation of the first switch 60 in the embodiment shown in FIG. 6 ; the specific implementation of the second switch 702 is also It can be implemented with reference to the second switch in the embodiment shown in FIG. 5 and FIG. 6 ; the specific implementation of the first firewall 703 can also be implemented with reference to the first firewall in the embodiment shown in FIG. 5 and FIG. 6 ; the second firewall 704 The specific implementation may also correspond to the implementation of the second firewall in the embodiments shown in FIG. 5 and FIG. 6 .

By running the message forwarding system 70, the first switch 701 sends the same message to the first firewall 703 and the second firewall 704, so that the first firewall 703 and the second firewall 704 establish a message based on the first message in the message. The same session entry, in this way, the second firewall 704 does not need to back up the session entry from the first firewall 703, and when the first firewall 703 fails, the second firewall 704 can directly The session entry takes over the service on the first firewall 703, avoiding service interruption.

To sum up, by implementing the embodiment of the present invention, the first switch sends the same packet to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same packet according to the first packet in the packet. In this way, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly replace the session entry based on the session entry established by itself. A business on a firewall to avoid business interruption.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and the program is During execution, it may include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes various media that can store program codes, such as ROM, RAM, magnetic disk, or optical disk.

The above embodiments only disclose the preferred embodiments of the present invention, and cannot limit the scope of the rights of the present invention. Those of ordinary skill in the art can understand that all or part of the procedures for realizing the above embodiments are implemented according to the claims of the present invention. Equivalent changes still fall within the scope of the invention.

Claims (13)

1. A message forwarding method is characterized by comprising the following steps:

a first switch receives a plurality of messages from a first network, the first switch is connected with a first firewall, a second firewall and the first network, the plurality of messages are messages transmitted between the first network and the second network, the first firewall is a main firewall, the second firewall is a standby firewall, the first firewall and the second firewall are respectively connected with the first switch and the second switch, and the second switch is also connected with the second network;

the first switch sends the plurality of messages to the first firewall and the second firewall respectively, the messages sent by the first switch to the first firewall and the second firewall are the same, so that the first firewall and the second firewall establish a session table item of a session to which a session head message belongs according to the session head message in the plurality of messages, the session table item comprises a quintuple, and the quintuple is used for judging whether the message flowing through the firewall belongs to the session;

the first switch receives a message of the session from the second network, which is sent by the first firewall;

and the first switch forwards the message of the session from the second network to the first network.

2. The method of claim 1, wherein after the first switch sends the plurality of packets to the first firewall and the second firewall, respectively, the method further comprises:

the first switch detects whether the first firewall is in failure or whether a link between the first switch and the first firewall is broken;

and if the first switch detects that the first firewall fails or a link between the first switch and the first firewall is interrupted, the first switch receives and forwards a message of the session from the second network, which is sent by the second firewall.

3. The method according to claim 2, wherein the first switch detects whether the first firewall fails, specifically:

and the first switch detects whether the first firewall has a fault or not through a bidirectional forwarding detection mechanism BFD.

4. The method of claim 2 or 3, wherein before the first switch detects the first firewall failure or a link between the first switch and the first firewall being broken, the method further comprises:

and the first switch does not receive the message of the session from the second network sent by the second firewall or receives and discards the message of the session from the second network sent by the second firewall.

5. The method of claim 4, wherein the first switch comprises a first interface to which the first switch is connected to the first firewall and a second interface to which the first switch is connected to the second firewall,

before the first switch detects that the first firewall fails or a link between the first switch and the first firewall is interrupted, the first interface is set as a main interface, and the second interface is set as a standby interface; the first switch receives and forwards the session message from the second network sent by the first firewall through the first interface, and the first switch does not receive the session message from the second network sent by the second firewall or receives the session message from the second network sent by the second firewall through the standby interface and discards the session message from the second network received through the standby interface;

after the first switch detects the first firewall failure or the link between the first switch and the first firewall is broken, the method further comprises:

setting the first interface as a standby interface, setting the second interface as a main interface, and receiving and forwarding a message of the session from the second network, which is sent by the second firewall, through the second interface.

6. A first switch, the first switch comprising a processor, a memory, and a network interface, wherein:

the network interface is used for receiving messages and sending messages;

the memory is used for storing instructions and data;

the processor is used for reading the instructions and data stored in the memory and executing the following operations:

receiving a plurality of messages from a first network through the network interface, wherein the first switch is connected with a first firewall, a second firewall and the first network, the plurality of messages are messages transmitted between the first network and the second network, the first firewall is a main firewall, the second firewall is a standby firewall, the first firewall and the second firewall are respectively connected with the first switch and the second switch, and the second switch is also connected with the second network;

the messages are respectively sent to the first firewall and the second firewall through the network interface, and the messages sent to the first firewall and the second firewall through the network interface are the same, so that the first firewall and the second firewall establish a session table item of a session to which a session head message belongs according to the session head message in the messages, wherein the session table item comprises a quintuple which is used for judging whether the message flowing through the firewall belongs to the session;

receiving a message of the session from the second network, which is sent by the first firewall, through the network interface;

and forwarding the message of the session from the second network to the first network through the network interface.

7. The first switch of claim 6, wherein after the processor sends the plurality of packets to the first firewall and the second firewall, respectively, via the network interface, the processor is further configured to:

detecting whether the first firewall breaks down or whether a link between the first switch and the first firewall is interrupted;

and if the first firewall fails or a link between the first switch and the first firewall is interrupted, receiving and forwarding a message of the session from the second network, which is sent by the second firewall, through the network interface.

8. The first switch of claim 7, wherein the processor detects whether the first firewall fails, and specifically:

and detecting whether the first firewall fails through a bidirectional forwarding detection mechanism BFD.

9. The first switch of claim 7 or 8, wherein before the processor detects the first firewall failure or a link between the first switch and the first firewall being down, the processor is further configured to:

and not receiving the message of the session from the second network sent by the second firewall, or receiving the message of the session from the second network sent by the second firewall through the network interface, and discarding the message of the session from the second network sent by the second firewall.

10. The first switch of claim 9, wherein the network interfaces comprise a first interface at which the first switch is connected to the first firewall and a second interface at which the first switch is connected to the second firewall,

before the processor detects that the first firewall fails or a link between the first switch and the first firewall is interrupted, the first interface is set as a main interface, and the second interface is set as a standby interface; the first switch receives and forwards the message of the session from the second network, which is sent by the first firewall, through the first interface, the first switch does not receive the message of the session from the second network, which is sent by the second firewall, or receives the message of the session from the second network, which is sent by the second firewall, through the second interface, and discards the message of the session from the second network, which is received through the second interface;

and after the processor detects that the first firewall is in fault or a link between the first switch and the first firewall is interrupted, the processor sets the first interface as a standby interface, sets the second interface as a main interface, and receives and forwards a message of the session from the second network, which is sent by the second firewall, through the second interface.

11. A message forwarding system is characterized by comprising a first switch, a second switch, a first firewall and a second firewall; the first switch is connected with a first firewall, a second firewall and a first network, the first firewall is a main firewall, the second firewall is a standby firewall, the first firewall and the second firewall are respectively connected with the first switch and the second switch, and the second switch is further connected with the second network, wherein:

the system comprises a first switch, a second switch and a third switch, wherein the first switch is used for receiving a plurality of messages from a first network, and the messages are transmitted between the first network and a second network; the messages are respectively sent to the first firewall and the second firewall, and the messages sent by the first switch to the first firewall and the second firewall are the same;

the first firewall and the second firewall are respectively used for establishing a session table item of a session to which the session head message belongs according to the session head message in the plurality of messages sent by the first switch, the session table item comprises a quintuple, and the quintuple is used for judging whether the message flowing through the firewall belongs to the session;

the first firewall is further configured to forward a packet of the session from the second network to the first switch;

the first switch is further configured to receive a packet of the session from the second network, where the packet is sent by the first firewall;

the first switch is further configured to forward the packet of the session from the second network to the first network.

12. The system of claim 11, wherein the first switch comprises a first interface for connecting the first switch to the first firewall and a second interface for connecting the first switch to the second firewall, wherein the second firewall is further configured to forward packets of the session from the second network to the first switch;

the first switch is configured to detect whether the first firewall fails or whether a link between the first switch and the first firewall is interrupted, and set the first interface as a primary interface and the second interface as a backup interface before detecting that the first firewall fails or the link between the first switch and the first firewall is interrupted; after the first firewall fault or the link between the first switch and the first firewall is detected to be interrupted, setting the first interface as a standby interface and setting the second interface as a main interface;

before detecting that the first firewall is faulty or a link between the first switch and the first firewall is interrupted, receiving messages of the session from the second network, which are sent by the first firewall and the second firewall, through the first interface and the second interface respectively, and discarding the messages of the session from the second network, which are received through the second interface;

after detecting that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, respectively receiving, through the second interface, the packet of the session from the second network sent by the second firewall, and forwarding, to the first network, the packet of the session from the second network received through the second interface.

13. The system of claim 11, wherein:

the second firewall is further configured to detect whether the second firewall is a standby firewall, and if the second firewall is the standby firewall, prohibit forwarding the packet of the session from the second network to the first switch, and prohibit forwarding the packet of the session from the first network to the second switch.

Images