CN101883040B - Network protection method and network protection architecture - Google Patents

Abstract

The invention provides a network protection method and a network protection system. In a network based on PBB-TE, a partial network is determined, and a working section and a protection section are set in the determined partial network. When the path of the working section fails, only the traffic of the path of the working section is switched to the path of the protection section instead of switching over the whole path, which improves the speed of fault recovery and reduces the number of nodes involved in protection switching.

Description

A network protection method and network protection system

technical field

The present invention relates to network protection technology, in particular to a network protection method and network protection system based on carrier-grade Ethernet technology, that is, a provider backbone bridging technology (PBB-TE, Provider Backbone Bridge Traffic Engineering) that supports traffic engineering.

Background technique

Due to its simplicity, high efficiency and low cost, Ethernet technology has been widely used in local area networks, and is rapidly shifting from a LAN-based networking technology to an enterprise network, a metropolitan area telecommunication network and a wide area telecommunication network. Such as the development of large-scale networking technology, therefore, the carrier-class Ethernet technology came into being.

The Institute of Electrical and Electronics Engineers (IEEE, Institute of Electrical and Electronics Engineers) proposed a carrier-grade Ethernet technology called PBB-TE, and the corresponding standard is IEEE802.1Qay. PBB-TE, also known as Provider Backbone Transport (PBT, Provider Backbone Transport) technology, is a connection-oriented Ethernet technology, and all traffic is forwarded according to the address table. PBB-TE technology is based on Provider Backbone Bridge (PBB, Provider Backbone Bridge, the corresponding standard is IEEE802.1ah) technology. Its core is the improvement of PBB technology. Through network management and control, the business in Ethernet In order to realize the functions of protection switching, operation, administration and maintenance (OAM, Operation, Administration and Management), service quality (QoS, Quality of Service), traffic engineering and other functions of the telecommunications network. PBB-TE technology uses the outer MAC plus the outer virtual local area network (VLAN, Virtual Local Area Network), that is, the destination MAC address (B-DA) of the backbone network and the VLAN ID (B-VID) of the backbone network for service forwarding. The forwarding path is pre-configured. PBB-TE technology is compatible with the architecture of traditional Ethernet bridges. It can forward data frames based on B-DA and B-VID without updating the intermediate nodes of the network. The data frames do not need to be modified, and the forwarding efficiency is high.

In order to improve the reliability of the network, an end-to-end protection mechanism is adopted in the PBB-TE-based network, that is, there are two tunnel entities between the end-to-end, namely the working entity and the protection entity, and the connectivity in IEEE802.1ag is adopted The fault management (CFM, Connectivity Fault Management) mechanism continuously checks the status of the working entity and the protection entity respectively. When the working entity fails, the service is automatically transferred to the pre-established protection entity. This end-to-end protection mechanism adds necessary flexibility to the PBB-TE network. FIG. 1 is a schematic structural diagram of an end-to-end protection mechanism in a PBB-TE-based network in the prior art. As shown in FIG. 1, in a PBB-TE network, PE1 and PE2 are nodes at both ends of a working entity and a protection entity. The path of the working entity is PE1-P1-P2-P3-PE2, and the path of the protection entity is PE1-P4-P5-PE2. The working entity and the protection entity are preset with respective VLANs.

When the traffic enters the PBB-TE network, the end node (such as the node PE1 in Figure 1, also known as the edge node) encapsulates the frame as Frame format, that is, to encapsulate a layer of frame header on the original data frame header. In the newly encapsulated frame header, the source MAC address in the backbone MAC address (B-MAC) is the MAC address of the ingress node PE1, and the destination MAC address is the MAC address of the egress node PE2. In addition, information such as the tag (I-tag) and B-VID of the service VLAN is also encapsulated in the new frame header, where the B-VID is the VLAN preset by the working entity or protection entity selected for transmission.

When both the working entity and the protection entity are in the normal state, PE1 encapsulates the B-VID of the frame in the traffic into the VLAN of the working entity, and the traffic is transmitted from the working entity, and its transmission path is PE1-P1-P2-P3-PE2, for example Figure 1 shows. When the working entity fails, PE1 encapsulates the B-VID of the frame in the traffic into the VLAN of the protection entity, and the traffic is switched to the protection entity for transmission. The transmission path is PE1-P4-P5-PE2, as shown in Figure 2. 2 is a schematic diagram of traffic after protection switching occurs in a PBB-TE-based network in the prior art.

When traffic is transmitted to another end node of the PBB-TE network (eg node PE2 in Figure 1, also known as an edge node), the egress node restores the frame in the PBB-TE network to a common data frame format and then outputs it.

Judging from the structure of the current end-to-end protection mechanism, end-to-end protection can only perform full-path protection. In this way, when the paths of the working entity and the protection entity are both long, the probability that the working entity and the protection entity fail at the same time If the working entity and the protection entity fail at the same time, the end-to-end traffic will be lost. For the case that a section of the path of the working entity or the protection entity is particularly vulnerable or a section is particularly important, the failure of this section will cause the entire path to be switched, which is not conducive to network optimization. The existing PBB-TE-based end-to-end protection mechanism architecture in the network can only perform full-path protection, which slows down the speed of fault recovery, and protection switching involves all nodes in the full path, which is not conducive to network optimization and reduces This ensures the reliability of end-to-end traffic.

Contents of the invention

In view of this, the main purpose of the present invention is to provide a network protection method, which can improve the speed of fault recovery, reduce the number of protection switching nodes, facilitate network optimization, and ensure the reliability of end-to-end traffic.

Another object of the present invention is to provide a network protection system, which can improve the speed of fault recovery, reduce the number of nodes for protection switching, facilitate network optimization, and ensure the reliability of end-to-end traffic.

In order to achieve the above object, technical solution of the present invention is achieved in that way:

A network protection method, in a network based on the operator's backbone bridging technology PBB-TE supporting traffic engineering, the method comprises the following steps:

Set the working segment and the protection segment in the determined local network;

Determine whether to transmit traffic through the working segment, if yes, the ingress node of the working segment encapsulates the received data frame into the transmission format of the working segment, and transmits the encapsulated data frame through the port of the working segment; the output node of the working segment will The data frame is restored to the frame information before entering the entry node of the working segment and forwarded; end this process;

If not, the ingress node of the protection segment encapsulates the received data frame into the transmission format of the protection segment, and transmits the encapsulated data frame through the port of the protection segment; the output node of the protection segment restores the data frame to the ingress The frame information before the end node is forwarded.

The partial network is determined according to the actual situation of the network.

Among the end nodes of the working segment and the protection segment, at least one of the end nodes is the same end node.

The virtual local area network VLAN for forwarding traffic in the working segment is different from the VLAN for forwarding traffic in the protection segment.

The method for judging whether to transmit traffic through the working section includes: performing state detection on the working section and the protection section, and when the detection result shows that both the working section and the protection section are normal and there is no protection switching request, the protected traffic passes through the working section Transmission: When the detection result shows that the working segment fails, or there are other protection switching requests, the protected traffic is transmitted through the protection segment.

The state detection method is a connectivity fault management (CFM) mechanism.

The inbound node of the working segment encapsulates the received data frame into the transmission format of the working segment specifically including:

Replace the backbone network VLAN ID B-VID of the protected data frame received from outside the local network with the VLAN of the working segment, and replace the source address in the backbone MAC address B-MAC of the data frame with the entry node of the working segment Node MAC address, and the destination address is replaced with the node MAC address of the outgoing node of the working segment.

The ingress node of the protection segment encapsulates the received data frame into a transmission format of the protection segment specifically including:

Replace the B-VID of the protected data frame received from outside the local network with the VLAN of the working segment, replace the source address in the B-MAC of the data frame with the node MAC address of the entry node of the protection segment, and replace the destination address with Indicates the node MAC address of the outbound node of the protection segment.

A network protection system, including a determined partial network in a network based on the carrier backbone bridging technology PBB-TE supporting traffic engineering, and a working segment and a protection segment are set in the determined partial network;

When traffic is transmitted through the working segment, the ingress node of the working segment encapsulates the received data frame into the transmission format of the working segment, and transmits the encapsulated data frame through the port of the working segment; the output node of the working segment restores the data frame For the frame information before entering the entry node of the working segment and forwarding;

When transmitting traffic through the protection segment, the ingress node of the protection segment encapsulates the received data frame into the transmission format of the protection segment, and transmits the encapsulated data frame through the port of the protection segment; the output node of the protection segment restores the data frame For the frame information before entering the ingress node of the protection segment and forwarding.

Among the end nodes of the working segment and the protection segment, at least one of the end nodes is the same end node.

The VLAN for forwarding traffic in the working segment is different from the VLAN for forwarding traffic in the protection segment.

It can be seen from the technical solution provided by the present invention that in the PBB-TE-based network, a partial network is determined, and a working section and a protection section are set in the determined partial network. When the path of the working section fails, only the traffic of the path of the working section is switched to the path of the protection section instead of switching over the whole path, which improves the speed of fault recovery and reduces the number of nodes involved in protection switching. The solution of the invention is beneficial to the optimization of the network, and ensures the reliability of the end-to-end flow. Among them, the local network refers to a part of the network in the protected network, which can be called a local area, or a segment or a segmented network. It is determined in advance according to the actual situation of the network, such as some particularly vulnerable or important Segments can be set as local regions. In this paper, the protection of a local network may also be called local area protection or area protection, segment protection or segment protection, or other similar names.

Description of drawings

FIG. 1 is a schematic structural diagram of an end-to-end protection mechanism in a PBB-TE-based network in the prior art;

FIG. 2 is a schematic diagram of traffic after protection switching occurs in a PBB-TE-based network in the prior art;

Fig. 3 is the flowchart of the method for realizing network protection of the present invention;

4 is a schematic structural diagram of a local network protection mechanism in a PBB-TE-based network according to the present invention;

FIG. 5 is a schematic diagram of traffic after protection switching occurs in a PBB-TE-based network according to the present invention.

Detailed ways

Fig. 3 is the flow chart of the method for realizing network protection of the present invention, as shown in Fig. 3, in the network based on PBB-TE, comprise the following steps:

Step 300: Set a working segment and a protection segment in the determined partial network.

A partial network refers to a part of the protected network, which can be called a partial area, or a segment or a segmented network. It is determined in advance according to the actual situation of the network. For example, some segments that are particularly vulnerable or important can Set to local area. In this paper, the protection of a local network may also be called local area protection or area protection, segment protection or segment protection, or other similar names.

There are two end nodes at the ends of the working segment and the protection segment respectively, and at least one of the end nodes of the working segment and the protection segment overlaps to be the same end node. A working segment port and a protection segment port are set on the ingress node, and a working segment port and a protection segment port are set on the egress node.

Address tables for traffic forwarding are preset in the nodes on the working segment and the protection segment, wherein the VLAN for forwarding traffic for the working segment is different from the VLAN for forwarding traffic for the protection segment. The specific setting method belongs to technical means available to those skilled in the art, and will not be repeated here.

This step emphasizes that in the PBB-TE-based network, the partial network that needs to be protected is determined, and the working segment and the protection segment are set in the determined partial network. Among them, there may be one or more than one partial network, and the specific number is related to the actual situation that needs to be protected.

Step 301: Determine whether traffic is transmitted through the working segment, if yes, go to step 302, otherwise go to step 304.

To detect the status of the working segment and the protection segment, the connectivity fault management (CFM, Connectivity Fault Management) mechanism in IEEE802. result.

According to the detection result, it is determined to transmit the protected traffic on the working segment or the protection segment. When the detection result shows that both the working segment and the protection segment are normal and there is no protection switching request, the protected traffic is transmitted on the working segment; when the detection result shows that the working segment is faulty or there are other protection switching requests, the protected traffic Transmit on the protection segment.

It should be noted that the status detection of the working segment and the protection segment in this step belongs to the prior art, and existing methods other than the CFM mechanism can be used, which do not limit the protection scope of the present invention.

Step 302: The ingress node of the working segment encapsulates the received data frame into the transmission format of the working segment, and transmits the encapsulated data frame through the port of the working segment.

When the data frame enters the ingress node of the working segment, replace the B-VID of the protected data frame received from outside the local network with the VLAN of the working segment, and replace the source address in the B-MAC of the data frame with the working segment After the node MAC address of the ingress node, the destination address is replaced with the node MAC address of the egress node of the working segment, the data frame is sent to the egress node of the working segment through the port of the working segment.

Step 303: The output node of the working segment restores the data frame to the frame information before entering the in-end node of the working segment and forwards it. End this process.

When the output node of the working segment receives the data frame on the working segment, it restores the B-MAC and B-VID of the data frame to the values before entering the working segment and then forwards it.

Step 304: The ingress node of the protection segment encapsulates the received data frame into the transmission format of the protection segment, and transmits the encapsulated data frame through the port of the protection segment.

When the data frame enters the ingress node of the protection segment, replace the B-VID of the protected data frame received from outside the local network with the VLAN of the working segment, and replace the source address in the B-MAC of the data frame with the protection segment After the node MAC address of the ingress node, the destination address is replaced by the node MAC address of the egress node of the protection segment, the data frame is sent to the egress node of the protection segment through the port of the protection segment.

Step 305: The output node of the protection segment restores the data frame to the frame information before entering the input node of the protection segment and forwards it.

When the output node of the working segment receives the data frame on the working segment, it restores the B-MAC and B-VID of the data frame to the values before entering the working segment and then forwards it.

Corresponding to the method shown in FIG. 3 , the present invention also provides a network protection system, which includes the determined local network in the network based on the carrier backbone bridging technology PBB-TE supporting traffic engineering, and, in the determined A working segment and a protection segment are set in the local network;

When traffic is transmitted through the working segment, the ingress node of the working segment encapsulates the received data frame into the transmission format of the working segment, and transmits the encapsulated data frame through the port of the working segment; the output node of the working segment restores the data frame For the frame information before entering the entry node of the working segment and forwarding;

When transmitting traffic through the protection segment, the ingress node of the protection segment encapsulates the received data frame into the transmission format of the protection segment, and transmits the encapsulated data frame through the port of the protection segment; the output node of the protection segment restores the data frame For the frame information before entering the ingress node of the protection segment and forwarding.

Among the end nodes of the working segment and the protection segment, at least one of the end nodes is the same end node. Moreover, the VLAN for forwarding traffic in the working segment is different from the VLAN for forwarding traffic in the protection segment.

The method of the present invention will be specifically described below in conjunction with an embodiment.

Figure 4 is a schematic structural diagram of the local network protection mechanism in the PBB-TE-based network of the present invention. As shown in Figure 4, PE1-P1-P2-P3-PE2 is a traffic transmission entity of a network based on PBB-TE technology, PE1 and PE2 as end nodes. Assume that P1-P2-P3 is the working segment of the local network protection in this embodiment, and P1-P4-P3 is the protection segment of the local network protection in this embodiment, and the working segment and the protection segment have the same end nodes P1 and P3. When the data frame is transmitted from the PE1 node to the network based on PBB-TE technology, the source address in the B-MAC of the data frame is the node MAC address of PE1, the destination address is the node MAC address of PE2, and the B-VID is the traffic transmission The pre-configured VLAN on the entity (assumed to be VID1 here).

When the detection result shows that the path on the working segment is normal, the data frame is re-encapsulated at the ingress node P1 of the working segment, the source address in the B-MAC of the frame is replaced with the node MAC address of P1, and the destination address is replaced with The node MAC address and B-VID of P3 are replaced by the VLAN (assumed to be VID2) configured on the working segment, wherein VID1 and VID2 may or may not be the same. Afterwards, the encapsulated traffic is sent to the egress node of the working segment. After the data frame is transmitted to the output node P3 of the working segment, the data frame is restored to the frame information before entering the local network, that is, the source address in the B-MAC of the data frame is restored to the node MAC address of PE1, and the destination address is restored to PE2 The MAC address of the node, and the B-VID is restored to the VID1 configured on the traffic transmission entity.

When the detection result shows that the working segment fails, or there are other protection switching requests, the protected traffic is switched to the protection segment for transmission. As shown in FIG. 5 , FIG. 5 is a schematic diagram of traffic after protection switching occurs in the PBB-TE-based network of the present invention. The data frame is re-encapsulated at the ingress node P1 of the protection segment, the source address in the B-MAC of the data frame is replaced with the node MAC address of P1, and the destination address is replaced with the node MAC address of the egress node P3 of the protection segment, The B-VID is replaced with the pre-configured VLAN on the protection segment (assumed to be VID3), and then the encapsulated traffic is sent to the egress node of the protection segment. After the data frame is transmitted to the output node of the protection segment, the data frame is restored to the frame information before entering the local network, that is, the source address in the B-MAC of the data frame is restored to the node MAC address of PE1, and the destination address is restored to PE2 The MAC address of the node, the B-VID is restored to the VID1 configured on the transport entity.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (9)

1. A network protection method, in a network based on a provider backbone bridging technology PBB-TE supporting traffic engineering, the method comprising the steps of:

setting a working section and a protection section in the determined local network; the local network is a part of a protected network;

judging whether the flow is transmitted through the working section, if so, encapsulating the received data frame into a transmission format of the working section by an input end node of the working section, and transmitting the encapsulated data frame through a port of the working section; the data frame is restored to the frame information before entering the working section input end node by the output end node of the working section and is forwarded; ending the flow;

if not, the ingress node of the protection segment encapsulates the received data frame into a transmission format of the protection segment, and transmits the encapsulated data frame through the protection segment port; the data frame is restored to the frame information before entering the protection section input end node by the output end node of the protection section and is forwarded; wherein,

the encapsulating, by the ingress node of the working segment, the received data frame into the transmission format of the working segment specifically includes: replacing a backbone network VLAN ID B-VID of a protected data frame received from the outside of a local network with a VLAN of a working section, replacing a source address in a backbone MAC address B-MAC of the data frame with a node MAC address of an input end node of the working section, and replacing a destination address with a node MAC address of an output end node of the working section;

the encapsulating, by the ingress node of the protection segment, the received data frame into the transmission format of the protection segment specifically includes: the method comprises the steps of replacing the B-VID of a protected data frame received from the outside of a local network with the VLAN of a working section, replacing the source address in the B-MAC of the data frame with the node MAC address of an input end node of the protection section, and replacing the destination address with the node MAC address of an output end node of the protection section.

2. The network protection method according to claim 1, wherein the local network is determined according to an actual condition of the network.

3. The network protection method of claim 1, wherein at least one of the end nodes of the working segment and the protection segment is the same end node.

4. The method of claim 1, wherein the VLAN of the working segment forwarding traffic is different from the VLAN of the protection segment forwarding traffic.

5. The network protection method according to claim 1, wherein the method for determining whether to transmit traffic through the working segment comprises: detecting the states of the working section and the protection section, and transmitting the protected flow through the working section when the detection result shows that the working section and the protection section are normal and no protection switching request exists; when the detection result shows that the working section has a fault or other protection switching requests exist, the protected traffic is transmitted through the protection section.

6. The network protection method according to claim 1, wherein the status detection method is a Connectivity Fault Management (CFM) mechanism.

7. A network protection system is characterized in that a network based on an operator backbone bridging technology PBB-TE supporting traffic engineering comprises a determined local network, and a working section and a protection section are arranged in the determined local network; the local network is a part of a protected network;

when the flow is transmitted through the working section, the input end node of the working section encapsulates the received data frame into a transmission format of the working section, and transmits the encapsulated data frame through the port of the working section; the data frame is restored to the frame information before entering the working section input end node by the output end node of the working section and is forwarded;

when the flow is transmitted through the protection section, the input end node of the protection section encapsulates the received data frame into a transmission format of the protection section, and transmits the encapsulated data frame through the port of the protection section; the data frame is restored to the frame information before entering the protection section input end node by the output end node of the protection section and is forwarded; wherein,

the encapsulating, by the ingress node of the working segment, the received data frame into the transmission format of the working segment specifically includes: replacing a backbone network VLAN ID B-VID of a protected data frame received from the outside of a local network with a VLAN of a working section, replacing a source address in a backbone MAC address B-MAC of the data frame with a node MAC address of an input end node of the working section, and replacing a destination address with a node MAC address of an output end node of the working section;

the encapsulating, by the ingress node of the protection segment, the received data frame into the transmission format of the protection segment specifically includes: the method comprises the steps of replacing the B-VID of a protected data frame received from the outside of a local network with the VLAN of a working section, replacing the source address in the B-MAC of the data frame with the node MAC address of an input end node of the protection section, and replacing the destination address with the node MAC address of an output end node of the protection section.

8. The network protection system of claim 7, wherein at least one of the end nodes of the working segment and the protection segment is the same end node.

9. The network protection system of claim 7, wherein the VLAN for which the working segment forwards traffic is different from the VLAN for which the protection segment forwards traffic.