CN101005437A - Method and system for realizing heap virtual local area network - Google Patents

Abstract

The invention discloses a method and system for realizing a stacked virtual local area network, comprising the steps of: a: classify and process data packets of ingress ports according to relevant flow characteristics; b: designate corresponding cvids for different flows according to the above classification results , Tpid. The system includes: a flow processing unit, a cvid distribution unit and a configuration data management unit; the flow processing unit further includes a flow classifier and a svid distribution unit. Through the method of the present invention, two layers of vlan tags can be added to the untag data message, and cvid can be added to the data message with the vlan tag, so that the Q-in-Q tunnel can be used to carry out cross-domain data at the unequal network level communication.

Description

A method and system for implementing a stacked virtual local area network

technical field

The invention relates to a method and system for realizing Q-in-Q (stacking virtual local area network).

Background technique

At present, the realization of Q-in-Q is generally based on the communication between peer-to-peer networks based on the premise that the data packets of the access port have a vlan tag (virtual local area network tag). Datagrams without a vlan tag on the access port can generally only encapsulate one layer of vlan tag, that is, svid (serviceprovide vlan id, virtual local area network label provided by the service provider); for datagrams with a vlan tag on the access port The text is generally encapsulated with a layer of svid.

The implementation method of this Q-in-Q has the following disadvantages:

a. The access port data packets are required to have vlan tag information, so that the access terminal must be connected to a device such as a switch to plan vlan tag information for the data packets of the network, which makes the network lose certain flexibility;

b. If the access port data message has vlan tag information, then the vlantag cannot be used as svid while adding cvid (the virtual local area network tag of the client), which makes the network lose certain flexibility;

c. The two parties in the mutual communication need peer-to-peer network level. As shown in Figure 1, if PC1 in domain 1 wants to communicate with PC1 in domain 2, PC1 in domain 1 and PC1 in domain 2 must communicate on Level three at the network level.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method and system for realizing Q-in-Q, so as to solve the data message that cannot be untag (no virtual local area network label) at the entrance of the access terminal in the existing Q-in-Q implementation mode The defect of performing Q-in-Q (the message contains svid, cvid) tunnel forwarding, and the problem that cvid cannot be added under the condition that the data message of the access port has a vlan tag.

In order to solve the problems of the technologies described above, the present invention is achieved through the following technical solutions:

A method for realizing a stacked virtual local area network, comprising the steps of:

a: Classify and process the data packets of the ingress port according to the relevant flow characteristics;

b: Assign corresponding cvid and Tpid (label protocol identifier) to different streams according to the above classification results.

Wherein, said step a comprises the steps of:

a1: Classify data packets according to the flow characteristics configured by the user;

a2: Add a stream feature ID to each feature stream, and assign corresponding svids to different streams according to the results.

Wherein, in the step a2, if the access port data has a vlan tag, and the vlan tag is used as the svid during networking, the svid may not be redistributed, and a new svid may be assigned to replace the original vlan tag.

Wherein, after the step b, it also includes: at the exit, build two tables, one is indexed by the port number of the entrance, and there is a key bit add_inner_tag in it, which is used to indicate adding cvid. If add_inner_tag is set, then follow the entry The flow ID index of the corresponding cvid; the other one is indexed by the port number of the exit, which contains the key bit remove_inner_tag, which is used to delete the cvid. If the remove_inner_tag is set, the cvid carried in the data packet will be deleted.

A system for realizing a stacked virtual local area network, comprising: a flow processing unit, a cvid distribution unit and a configuration data management unit; The classification result of the stream processing unit assigns corresponding cvids to different streams at the exit, and the function of the configuration data management unit is to manage the configured data.

Wherein, the stream processing unit includes a stream classifier and a svid allocation unit; the role of the stream classifier is to classify streams according to certain characteristics, and the role of the svid allocation unit is to assign different streams according to the result of stream classification The corresponding svid.

The present invention has following beneficial effect:

a. In the existing networking environment, the function of double-layer tag can be added to the data message with the vlan tag of the access network as untag at the same time, which improves the network level of the access end, and the data message of the access port has In the case of vlan tag, you can use the vlan tag as svid or replace the vlan tag of the data packet with a new svid and add cvid at the same time;

b. Realized the use of Q-in-Q tunnels for cross-domain data communication at the unequal network level, improved the flexibility of network planning, and added new network services to the current qualitative network and became operational in the vertical direction;

c. Since the present invention does not increase any hardware cost and the software cost increases little, the expansibility, ease of maintenance, and ease of planning of the network are greatly improved.

Description of drawings

FIG. 1 is a schematic diagram of a network level realized by Q-in-Q in the prior art;

Fig. 2 is a schematic diagram of the network hierarchy that can be realized by Q-in-Q after adopting the present invention;

Fig. 3 is a module composition diagram of the present invention;

Fig. 4 is VLAN classification, label mapping module flowchart in the present invention;

FIG. 5 is a diagram illustrating a networking example of Embodiment 1 of the present invention;

FIG. 6 is a diagram of a networking example of Embodiment 2 of the present invention.

Detailed ways

As shown in Fig. 3, the present invention mainly consists of the following module units: stream processing unit, cvid distribution unit and configuration data management unit. The stream processing unit also includes a stream classifier and a svid allocation unit. The stream classifier is used to classify streams according to certain characteristics, and the svid allocation unit is used to assign corresponding svids to different streams according to the results of stream classification; the cvid allocation unit According to the result of the ingress flow classifier, the corresponding cvid is assigned to different flows at the exit; the configuration data management unit is used to provide a man-machine interface, manage the configured data, and can configure whether to untag the data packets of the access port Add double vlan tag and related data, etc.

As shown in Fig. 4, the main working process of the VLAN classification and label mapping module of the present invention includes two parts, as shown in Fig. 4-1, the ingress flow chart and Fig. 4-2, the egress flow chart. In the inbound process, when the data packet enters the access terminal, the flow classification function of ACL (Access Control List) is used to classify the flow characteristics configured by the user, and a flow characteristic ID is assigned to each characteristic flow, and at the same time according to the result Assign different svids to streams (composed of s-pri (server 802.1q), s-cfi (server rule format indicator), s-vid (server virtual LAN ID)), if the access port data With vlan tag information, and the imported vlan tag is used as svid during networking, at this time, svid may not be redistributed, or a new svid may be assigned to replace the original vlantag; then enter L2, L3 for learning, Forward. In the export process, at the exit, build two tables, one is indexed by the port number of the entrance, and there is a key bit add_inner_tag, which is used to indicate the addition of cvid, and if add_inner_tag is set, index according to the incoming stream ID Its corresponding cvid (composed of three parts: c-pri (client 802.1q), c-cfi (client rule format indicator), c-vid (client virtual LAN ID)). One is indexed by the port number of the exit, and the key bit remove_inner_tag is used to delete cvid. If remove_inner_tag is set, the cvid carried in the data packet will be deleted.

Below in conjunction with accompanying drawing and specific embodiment the present invention is described in further detail:

Embodiment 1: In the currently widely used Q-in-Q networking environment, the general cvid has been planned before, and with the continuous enrichment of business types, there is the possibility of re-planning various services. However, the originally planned vlan network is already very large, and it may be necessary to terminate all the original vlans if it hurts the whole body. Then use the business as a reclassified vlan according to the needs.

In this embodiment, use the method and system of the present invention to carry out configuration management, first terminate all the vlans attached to the accessed business, and then classify the flow according to the flow classifier in the present invention and re-classify it in the Q- VLAN planning on the in-Q network.

As shown in Fig. 5, according to the requirements of the data packet network of the access port, the ACL flow classifier is used to reclassify the flow to generate data characteristic flow 1, data characteristic flow 2, ..., data characteristic flow n. Then add or replace the specified svid with different characteristic flows, and carry out L2 and L3 learning and forwarding according to svid; The port adds the specified cvid based on the characteristic flow. In this way, the newly planned data flow can be operated on the Q-in-Q network.

Embodiment 2: At present, in an enterprise network, people with different permissions need to view enterprise resources differently. The general implementation method is to set a certain ac1 to distinguish between allowing or denying certain services for different ip addresses. Such a plan needs to update the settings of related devices when adding users, and there is a certain risk of misconfiguration, and the hardware resources of ac1 are limited. For a larger network, this implementation of ac1 has defects.

In this embodiment, the present invention can be used to assign cvid to the source data on the server, and to distinguish different permissions by cvid, so that once the network is planned, it is enough to divide the relevant users into different vlans. Simplifies network planning and makes maintenance easy.

As shown in Figure 6, the data flow is reclassified by the ac1 splitter at the access end of the server to generate financial data flow, personnel data flow, . . . , other data flows. Then add the specified svid to different feature flows, and perform L2 and L3 learning and forwarding according to svid; then implement QoS policy; finally add the specified cvid on the outbound port according to the feature flow. Use cvid to precisely locate a group of usage rights, and use svid to locate a group with a larger range. In this way, if a new PC is added in the future, it only needs to be assigned to the originally specified cvid.

Utilization of the present invention makes the unequal Q-in-Q realization under the existing Q-in-Q network a reality, as shown in Figure 2, the cross-domain communication between pc1 in domain 1 and pc2 in domain 2 can Communicate at the level, pc1 in domain 1 can communicate with pc1 in domain 2 on level three; and a new planning concept is given for the division of different access resource permissions in the enterprise network, expanding It improves the flexibility of network planning and ease of operation.

Claims (6)

1, a kind of method that realizes heap virtual local area network is characterized in that, comprises step:

A: according to relevant stream feature to the processing of classifying of the data message of inbound port;

B: virtual local area network tags cvid, the tag protocol identifier of homogeneous turbulence not being specified corresponding client according to above-mentioned classification results.

2, realize the method for heap virtual local area network according to claim 1, it is characterized in that described step a comprises step:

A1: the data message is classified according to user configured stream feature;

A2: stamp the stream characteristic ID for each feature stream, give the different corresponding svid of flow distribution according to the result simultaneously.

3, as the method for realization heap virtual local area network as described in the claim 2, it is characterized in that, among the described step a2, if the access interface data have the information vlan tag of virtual local area network tags, and when networking this vlan tag as svid, then can not redistribute svid, also can distribute a new svid to replace original vlan tag.

4, realize the method for heap virtual local area network according to claim 1, it is characterized in that, also comprise after the described step b: in the exit, build two tables, port numbers with inlet is an index, and crucial position add_inner_tag is wherein arranged, and is used for indication and adds cvid, if add_inner_tag is put, then according to its corresponding cvid of stream ID index that enters; Another port numbers with outlet is an index, and crucial position remove_inner_tag is wherein arranged, and is used to delete cvid, if remove_inner_tag is put, then the cvid with the data message band deletes.

5, a kind of system that realizes heap virtual local area network is characterized in that, comprising: stream processing unit, cvid allocation units and configuration data management unit; Described stream processing unit act as the processing of classifying of the data message of incoming end, the classification results according to stream processing unit of acting as of described cvid allocation units specifies corresponding cvid in the exit not homogeneous turbulence, and the data that act as configuration of described configuration data management unit manage.

6, as the system of realization heap virtual local area network as described in the claim 5, it is characterized in that described stream processing unit comprises flow classifier and svid allocation units; The convection current that act as according to user configured stream feature of described flow classifier is classified, and the effect of described svid allocation units is according to the result of traffic classification homogeneous turbulence not to be specified corresponding svid.

Images