CN101166138A - Device for Layer 2 Virtual Private Network Service Transmission - Google Patents

Abstract

The invention provides a device for two-layer virtual private network service transmission, which includes a setting module for setting the maximum transmission unit on the two-layer interface circuit on the user side; a detection module for making the two-layer interface circuit pair The received data packet is detected; and the forwarding module is used to make the layer 2 interface circuit forward the data packet when the received data packet is smaller than the maximum transmission unit, and make the layer 2 interface circuit forward the data packet when the received data packet is larger than the maximum transmission unit. The data packets forwarded by the interface circuit as non-Internet Protocol packets, and the data packets not forwarded as Internet Protocol packets and sending Internet Control Message Protocol packets are unreachable. Therefore, the device of the present invention can reduce the number of fragmented and reassembled data packets as much as possible, and even do not need fragmented reorganization in the transmission of the gateway protocol service for the second-layer business, thereby improving the performance of the second-layer virtual personal network.

Description

Device for Layer 2 Virtual Private Network Service Transmission

technical field

The present invention relates to a device for network service transmission, more specifically, to a device for two-layer virtual private network service transmission.

Background technique

With the development of the network, especially the network economy, the enterprises are expanding day by day, the distribution of customers is becoming wider and wider, and the number of partners is increasing day by day. This situation promotes the increasing benefits of enterprises, and on the other hand, the functional defects of traditional enterprise networks are becoming more and more prominent. : The leased line connection mode based on the fixed physical location of the traditional enterprise network has been difficult to meet the needs of modern enterprises. Therefore, enterprises put forward higher requirements for their own network construction, mainly in terms of network flexibility, security, economy, and scalability. In this context, the virtual personal network (VPN) has won the favor of more and more enterprises with its unique advantages, enabling enterprises to pay less attention to the operation and maintenance of the network and devote more attention to the enterprise realization of business goals. Layer 2 virtual personal networks that are widely used by enterprises include Layer 2 Tunneling Protocol (L2TP), Virtual Private LAN Service/Virtual Private Wire Service (VPLS/VPWS).

Fig. 1 is a schematic diagram showing a network diagram of a Layer 2 tunneling protocol. FIG. 2 is a structural diagram illustrating a structure generated after Internet Protocol Security (IPSec) tunnel data is encapsulated by a Layer 2 tunneling protocol. FIG. 3 is a block diagram showing a networking structure. FIG. 4 is a view showing a backbone network of an operator.

The Layer 2 Tunneling Protocol is a virtual personal network composed of PPP dial-up links and tunnels on the backbone network. Users access the enterprise network through the tunnel through the dial-up mode. The Layer 2 Tunneling Protocol is mainly used for mobile and personal users to access the company's internal network, saving users the cost of long-distance dial-up services. Figure 1 shows the networking diagram of the Layer 2 tunneling protocol.

The tunnel transmission of Layer 2 Tunneling Protocol data is realized through multi-level encapsulation. FIG. 2 is a structure generated after the IP security tunnel data is encapsulated by the layer-2 tunneling protocol. The IP security encapsulation is optional.

There are currently two main implementation schemes for Layer 2 virtual personal network technology based on multi-protocol label technology network, namely the Layer 2 Virtual Personal Network (hereinafter referred to as Kompella Layer 2 Virtual Personal Network) proposed by Kompella et al. Personal network (hereinafter referred to as Martini Layer 2 virtual personal network). The data planes of these two solutions are basically similar, and both can support a variety of data link layer technologies, such as frame relay, ATMAAL5 CPCS mode, ATM transparent cell mode, Ethernet, Ethernet VLAN, Cisco HDLC and PPP, etc. The main difference is the use of control plane protocols. The network diagram is shown in Figure 3.

As shown in Figure 4, taking PE1 as the source and PE2 as the destination, when PE1 sends a Layer 2 PDU to PE2, PE1 first adds a VC label to the Layer 2 payload, and then adds a tunnel label. Tunnel labels are used to determine the path of multi-protocol label technology (MPLS) packets from PE1 to PE2; only when MPLS packets reach PE2, VC labels are visible, and PE2's processing of packets depends on the content of VC labels.

Whether it is a virtual private area network service/virtual private line service or a layer-2 tunneling protocol service, they all belong to the category of a layer-2 virtual personal network, that is, a layer-2 data packet is packed into another IP packet payload for transmission. If the inner layer data packet is relatively large, plus the external IP packet overhead, the final formed data packet is likely to exceed the transmission maximum transmission unit (1518, including the Ethernet CRC check digit) of the Ethernet.

At present, the following solutions are available for the above problems:

One method is to realize fragmentation recombination service by the uplink interface of the broadband access server. According to the traditional data implementation, on the uplink interface of the broadband access server, after the layer-2 data packet is entered into the new layer-3 data packet, it is found that the maximum transmission unit (Maximum Transmit Unit, MTU) size configured on the interface is exceeded, According to the IP layer specification, the fragmentation function is realized. On this interface, if a downlink data packet is received, if it is a fragmented data packet, the reassembly function must be realized after the fragmented data packet is received, and then the outer layer data packet is stripped and forwarded to the user side.

Another method is to realize Jumbo Frame by the uplink interface of the broadband access server. We can also consider modifying the packet size from 1,500 bytes to 9,000 bytes (called jumbo frames). Jumbo frames can be set in a local network by setting the maximum transmission unit, which can greatly improve performance.

Using the above two methods, the transmission of large packets on the network can be realized. However, in Method 1, the Broadband Access Server (BRAS) must realize the function of fragmentation and reassembly of long packets, which seriously affects the transmission performance. However, using method 2, on the one hand, jumbo frames are not supported by every manufacturer, and the use is relatively limited. On the other hand, jumbo frames can only solve the link problem between the broadband access server and the router. There is no guarantee that fragmentation will not be reorganized, and there are also performance problems.

Contents of the invention

The purpose of the present invention is to provide a device for two-layer virtual private network service transmission, through the present invention can reduce the number of fragmented and reorganized data packets as much as possible, and even do not need fragmentation and reorganization in the transmission of IP services for two-layer services, so that Improve L2 VPN performance.

The present invention provides a device for improving the service transmission performance of a layer-2 virtual private network, which includes: a setting module for setting the maximum transmission unit on a layer-2 interface circuit on the user side; a detection module for making the layer-2 The interface circuit detects the received data packet; and the forwarding module is used to make the layer 2 interface circuit forward the data packet when the received data packet is smaller than the maximum transmission unit, and when the received data packet is larger than the maximum transmission unit, Make the Layer 2 interface circuit forward the data packets that are not Internet Protocol packets, and the data packets that are not forwarded as Internet Protocol packets and send an Internet Control Message Protocol (ICMP) packet unreachable identifier.

In the above-mentioned device for two-layer virtual private network service transmission, the setting device includes: a receiving module, used to enable the source host to receive the ICP error message sent by the user side; a processing module, used to send the maximum The segment size becomes the difference between the maximum transmission unit of the user side sending the IPCP error message and the IP data packet header and the transmission control protocol data packet header, and the next maximum transmission unit is tried; and the loop module , which is used to enable the user side to detect whether the maximum transmission unit is the maximum at a predetermined time period.

In the above-mentioned device for transmitting a Layer 2 VPN service, for the VPN service/Virtual private line service, the maximum transmission unit is set on the Virtual Forwarding Class (VFI).

In the above-mentioned device for transmitting Layer 2 virtual private network services, for Layer 2 tunneling protocol services, the maximum transmission unit is set in the Layer 2 tunneling protocol group.

In the above-mentioned device for transmitting a Layer 2 virtual private network service, for the Layer 2 tunneling protocol service, the information of the ICP error message is obtained from the Layer 2 tunneling protocol message at the user side.

In the above-mentioned device for transmitting Layer 2 virtual private network services, for virtual private area network service/virtual private line service, the information of the ICP error message is obtained from the Ethernet message on the user side.

In the above-mentioned device for two-layer virtual private network service transmission, the destination IP address of the IPCP is obtained from the source IP address of the data packet, and the IP address of the IPCP is obtained from the destination IP address of the data packet. The source IP address of the text protocol.

In the above-mentioned device for transmitting a Layer 2 virtual private network service, the maximum transmission unit of the IPCP is obtained from the maximum transmission unit of the user side.

In the above-mentioned device for transmitting Layer 2 virtual private network services, the format of the ICP error includes the following information: type, code, checksum, maximum transmission unit of the next-hop network, IP header, and original IP address. Data in protocol packets.

Therefore, the present invention can reduce the number of fragmented and reassembled data packets, and even do not need fragmentation and reorganization in the transmission of IP services for layer 2 services, thereby improving the performance of the layer 2 virtual personal network.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the description, and are used together with the embodiments of the present invention to explain the present invention, and do not constitute a limitation to the present invention. In the attached picture:

Fig. 1 is a schematic diagram showing a network diagram of a Layer 2 tunneling protocol;

Fig. 2 is a structural diagram showing the structure generated after the Internet Protocol Security Tunnel data is encapsulated by the Layer 2 Tunneling Protocol;

Fig. 3 is a block diagram showing a networking structure;

FIG. 4 is a view showing an operator's backbone network;

Fig. 5 is the flow chart of the method for two-layer virtual private network service transmission according to the present invention;

Fig. 6 is a block diagram of a device for transmitting a Layer 2 virtual private network service according to the present invention; and

Fig. 7 is a schematic diagram showing the format of an ICP unreachable error message;

Detailed ways

The preferred embodiments of the present invention will be described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described here are only used to illustrate and explain the present invention, and are not intended to limit the present invention.

Fig. 5 is a flowchart of a method for transmitting a Layer 2 virtual private network service according to the present invention.

Next, with reference to FIG. 5 , a method for transmitting a Layer 2 virtual private network service according to the present invention will be described.

First, a process of Layer 2 virtual private network service transmission.

In step 502, the maximum transmission unit is set on the Layer 2 interface circuit on the user side.

In step 504, the Layer 2 interface circuit detects the received data packet.

In step 506, when the received data packet is smaller than the maximum transmission unit, the layer 2 interface circuit forwards the data packet, and when the received data packet is larger than the maximum transmission unit, the layer 2 interface circuit forwards the data packet as a non-Internet Protocol packet , and the unreachable identifier of the data packet that is not forwarded as an Internet Protocol packet and sends an Internet Control Message Protocol packet.

Optionally, step 502 includes: the source host receives the ICP error message sent by the user side; and changes the maximum sending segment size to the maximum size of the user side sending the ICP error message. The difference between the transmission unit and the IP data packet header and the TCP data packet header, and try the next maximum transmission unit; and the user side detects whether the maximum transmission unit is the maximum at a predetermined time period.

Optionally, for the virtual private area network service/virtual private line service, the maximum transmission unit is set on the virtual forwarding class.

Optionally, for the Layer 2 tunneling protocol service, the maximum transmission unit is set in the Layer 2 tunneling protocol group.

Optionally, for the Layer 2 Tunneling Protocol service, the information of the ICP error message is obtained from the Layer 2 Tunneling Protocol message on the user side.

Optionally, for the virtual private area network service/virtual private line service, the information of the ICP error message is obtained from the Ethernet message on the user side.

Optionally, for the virtual private area network service/virtual private line service, the information of the ICP error message is obtained from the Ethernet message on the user side.

Optionally, the destination IP address of the IPCP is obtained from the source IP address of the data packet, and the source IP address of the IPCP is obtained from the destination IP address of the data packet.

Optionally, the maximum transmission unit of the Internet control message protocol is obtained from the maximum transmission unit of the user side.

Optionally, the format of the IPCP error includes the following information: type, code, checksum, MTU of the next-hop network, IP header, and data in the original IP packet.

Fig. 6 is a block diagram of a device for transmitting a Layer 2 virtual private network service according to the present invention.

Next, an apparatus for transmitting a Layer 2 virtual private network service will be described with reference to FIG. 6 .

In the device for the two-layer virtual private network service transmission, it includes: a setting module 602, which is used to set the maximum transmission unit on the two-layer interface circuit on the user side; a detection module 604, which is used to make the two-layer interface circuit receive the The data packet is detected; and the forwarding module 606 is used to make the layer 2 interface circuit forward the data packet when the received data packet is smaller than the maximum transmission unit, and make the layer 2 interface circuit forward the data packet when the received data packet is larger than the maximum transmission unit. A data packet that is forwarded as a non-Internet Protocol packet, and a data packet that is not forwarded as an Internet Protocol packet and sends an IPCP packet is unreachable.

The setting module 602 includes: a receiving module, which is used to make the source host receive the ICP error message sent by the user side; a processing module, which is used to change the maximum sending message segment size to sending the Internet control message The difference between the maximum transmission unit of the user side of the protocol error message and the Internet protocol data packet header and the transmission control protocol data packet header, and try the next maximum transmission unit; Checks if the maximum transmission unit is the maximum.

Optionally, for the virtual private area network service/virtual private line service, the maximum transmission unit is set on the virtual forwarding class.

Optionally, for the Layer 2 tunneling protocol service, the maximum transmission unit is set in the Layer 2 tunneling protocol group.

Optionally, for the Layer 2 Tunneling Protocol service, the information of the ICP error message is obtained from the Layer 2 Tunneling Protocol message on the user side.

Optionally, for the virtual private area network service/virtual private line service, the information of the ICP error message is obtained from the Ethernet message on the user side.

Optionally, the destination IP address of the IPCP is obtained from the source IP address of the data packet, and the source IP address of the IPCP is obtained from the destination IP address of the data packet.

Optionally, the maximum transmission unit of the Internet control message protocol is obtained from the maximum transmission unit of the user side.

Optionally, the format of the IPCP error includes the following information: type, code, checksum, MTU of the next-hop network, IP header, and data in the original IP packet. Fig. 7 is a schematic diagram showing the format of an ICP unreachable error message according to the first embodiment.

Realize a VPLS service example as follows according to the method for two-layer virtual private network service transmission provided by the present invention

The first step is to configure the maximum transmission unit on the Layer 2 interface circuit of the PE. For the virtual private area network service/virtual private line service, configure the maximum transmission unit (can be configured to 1400bytes) on the virtual forwarding class to ensure the maximum transmission unit After adding multi-protocol label technology or IP header to the value of the unit, there is still no need for fragmentation;

In the second step, the PE device normally forwards data packets smaller than the maximum transmission unit (1400bytes) on the layer 2 interface;

In the third step, the PE device does not forward the IP packet longer than the maximum transmission unit on the layer 2 interface, and responds that the IP packet is unreachable.

In the fourth step, the user computer receives the ICP unreachable message, and modifies the size of the sent data packet so that the PE device can forward it.

The fifth step is to normally forward the non-IP packets in the virtual private area network service/virtual private line service and pack them on the network side.

In the above method, the path MTU refers to the size of the maximum transferable unit of the path between the source host and the destination host. The principle is also to use IP data packets that are not allowed to be fragmented, and wait for an error in the Internet control packet protocol to estimate the size of the maximum transmission unit. The specific process includes the following steps:

In the first step, when the source host receives a newer ICP error message, it directly modifies its maximum sending segment size to that of the user side sending the ICP error message. The difference between the maximum transmission unit and the IP header and TCP header;

In the second step, when the source host receives a newer ICP error message, it must try the next maximum transmission unit (various network devices have a maximum transmission unit, and each maximum transmission unit starts from the maximum transmission unit to small "65535, 17914, 4464, 4352, 1500, 1492, 576, 296"; and

In the third step, because the route can be changed dynamically, the user side can use relatively large packets to detect the maximum transmission unit of the path every 10 minutes.

Among them, when the router receives a data packet that needs to be fragmented, and the flag bit of not fragmented (DF) is set in the IP header, if a program needs to determine the minimum and maximum transmission unit on the way to the destination , that is, the path maximum transmission unit discovery mechanism, then this error can be used by the program.

Moreover, the format of the ICP unreachable error message in this case is shown in FIG. 5 . In Fig. 5, in the second 32bit word, 16-31bit can provide the maximum transmission unit of the next station instead of 0.

In the embodiments disclosed in the present invention, it is also necessary to consider based on the following principles:

First of all, for a Layer 2 virtual personal network, the broadband access server device is the starting point of a Layer 2 tunnel. In principle, Layer 2 data packets should be transparently transmitted and inserted into the tunnel data packets intact.

Secondly, for a layer-2 circuit, if the data packet exceeds the maximum transmission unit of the layer-2 circuit, the network device will automatically discard the data packet without taking any action. This is determined by the service of the data link layer.

However, if the network layer is an IP packet, there is a means of IP maximum transmission unit path discovery described in Technical Principles. By reducing the size of the data packet sent by the end system and avoiding fragmentation and reassembly work in the core network, the performance of transmitting data is improved.

Moreover, in the present invention, the broadband access server device implements a layer-3 service on the layer-2 interface on the user side, and returns an inter-network control message for data packets that may exceed the maximum transmission unit of the link on the network side Agreement unreachable.

Moreover, according to this embodiment, an ICP packet design method is also provided.

Since the user side of the broadband access server is a Layer 2 device and has no IP address configuration, when the Internet Control Packet Protocol is used to notify the user, several key data in the Internet Control Packet Protocol should be considered to be filled in as follows:

1. Layer 2 packet information. Layer 2 data packet information is related to the user's business. For users using the Layer 2 tunneling protocol service, obtain Layer 2 information from the user's Layer 2 tunneling protocol message; for users using the VPN service/virtual private line service , to obtain information from the user's Ethernet packets.

2. Layer 3 packet information. The destination IP address of the Internet control message protocol, that is, the user IP address, is obtained from the source IP in the data packet; the source IP address of the Internet control message protocol, that is, the IP address accessed by the user, is obtained from the destination IP in the data packet; The maximum transmission unit in the IPCP is obtained from the user-side maximum transmission unit configured on the broadband access server.

Therefore, the present invention can reduce the number of fragmented and reassembled data packets as far as possible, and even do not need fragmentation and reorganization in the transmission of IP services for Layer 2 services, thereby improving the performance of the Layer 2 virtual personal network.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (9)

1. a device that is used to improve the L 2 virtual private network service conveying function is characterized in that, described device comprises:

Module is set, is used on two layer interface circuit of user side, MTU being set;

Detection module is used to make described two layer interface circuit that the packet that receives is detected; And

Forwarding module, be used for when the described packet that receives during less than described MTU, make described two layer interface circuit transmit described packet, when the described packet that receives during greater than described MTU, described two layer interface circuit are transmitted be the described packet of non-Internet protocol bag, and do not transmit the sign that described packet and transmission Internet Control Message Protocol bag for the Internet protocol bag can not arrive.

2. device according to claim 1 is characterized in that, described setting device comprises:

Receiver module is used to make source host to receive the Internet Control Message Protocol error message that is sent by described user side;

Processing module, be used for that maximum is sent the message segment size and become poor between the described MTU of the described user side that sends described Internet Control Message Protocol error message and internet protocol datagram packet header and the transmission control protocol data packet header, and attempt next described MTU; And

The circulation module, being used for the scheduled time is the cycle, whether make described user side detect described MTU is maximum.

3. device according to claim 2 is characterized in that, for virtual special local area network service/VLL service business, on virtual forwarding class described MTU is set.

4. device according to claim 2 is characterized in that, for the Layer 2 Tunneling Protocol business, described MTU is set in the Layer 2 Tunneling Protocol group.

5. device according to claim 2 is characterized in that, for the Layer 2 Tunneling Protocol business, obtains the information of described Internet Control Message Protocol error message from the Layer 2 Tunneling Protocol message of described user side.

6. device according to claim 2 is characterized in that, for virtual special local area network service/VLL service business, obtains the information of described Internet Control Message Protocol error message from the Ethernet message of described user side.

7. device according to claim 2, it is characterized in that, from the source Internet protocol of described packet, obtain the purpose internet protocol address of described Internet Control Message Protocol, and the internet protocol address, source that from the described purpose internet protocol address of described packet, obtains described Internet Control Message Protocol.

8. device according to claim 2 is characterized in that, obtains the MTU of described Internet Control Message Protocol from the described MTU of described user side.

9. device according to claim 2, it is characterized in that the form of described Internet Control Message Protocol mistake comprises following information: type, code, check and, the data in MTU, Internet protocol stem and the original internet protocol datagram bag of next stop network.

Images