CN1254059C - Method of realizing special multiple-protocol label exchanging virtual network - Google Patents

Abstract

The invention relates to the field of data exchange. A method for implementing an MPLS VPN, characterized in that it comprises the following steps: a. strategy is configured to equipment; b. the egress VPN edge side equipment (Egress PE) sends relevant information to the entrance VPN edge side equipment (Ingress PE); c .Ingress PE matches the received route with the policy. If successful, go to step d, otherwise discard; d. Create a policy routing table entry and save it in the policy route; e. Search for the outer layer tunnel according to the policy, and report The file is forwarded to the Exgress PE side. The present invention can select the tunnel according to the characteristics of the business to ensure that the service quality of the business can meet the customer's requirements, and can dynamically establish the MPLS TE LSP according to the needs of the private network business to meet the needs of the users.

Description

A Realization Method of Multi-protocol Label Switching Virtual Private Network

technical field

The invention relates to the field of data exchange, in particular to a method for realizing a virtual private network in multi-protocol label switching.

technical background

The earliest prototype of MPLS is the IPSwitching protocol first launched by Ipsilon in the mid-1990s. Its purpose is mainly to solve how ATM switches can better support IP. It overcomes the performance limitations of traditional routers. Following Cisco launched Tag Switching, IBM launched Aggregate Route-based IP Switch (ARIS) and so on. At that time, the purpose of router manufacturers to implement label switching was to solve the problem that IP routing search could not reach the wire speed (because IP routing search used the longest address matching method, software search would be difficult when the router port speed reached 155M or 622M) . There are interoperability problems in the implementation of label switching of these early different manufacturers, so in 1997, IETF established a working group responsible for label switching standardization --- MPLS working group. It is independent of each device implementation vendor. The existing MPLS-related protocols and drafts basically come from this working group and its derived traffic engineering working group and MPLS VPN working group.

With the rapid development of network processor technology, it is no longer a problem to search for routes at 2.5G or even 10G ports at line speed, and MPLS applications are gradually turning to MPLS traffic engineering and MPLS VPN. In an IP network, MPLS traffic engineering technology has become an important tool for managing network traffic, reducing congestion, and ensuring IP network QoS to a certain extent. In terms of solving enterprise interconnection and providing various new services, MPLS VPN is also more and more favored by operators, and has become an important means for IP network operators to provide value-added services! The use of MPLS VPN technology can decompose the existing IP network into logically isolated networks. The application of this logically isolated network can be varied: it can be used to solve the problem of separate interconnection of enterprises and the same/different government departments. Separate interconnection can also be used to provide new services—such as opening a VPN for IP telephone services, so as to solve the shortage of IP network addresses, QoS guarantee, and develop new services and other applications.

The original solution of MPLS VPN is to use LSP as the outer layer tunnel to carry VPN private network information. Since the large-scale promotion of MPLS still needs time, some of the latest MPLS technologies can use the GRE, IPSEC and other tunnels provided by the devices on the Internet as the outer layer tunnels. At the same time, due to the mature technology of MPLS TE, LSPs with different attributes (mainly referring to bandwidth) can be established between PEs. In this way, various outer layer tunnels (including LSP, GRE, etc.) and different LSPs (TE can establish LSPs with different paths/bandwidths between the same source and destination). There is a problem of how to choose between these outer layer tunnels like this.

1. MPLS VPN includes two types: BGP/MPLS VPN and L2VPN:

BGP (Border Gateway Protocol, Border Gateway Protocol)/MPLS VPN was proposed by E. Rosen and Y. Rekhter in 1999, forming RFC2547. It is a VPN (Provider Provide VPN, PP VPN for short) provided by the operator. The VPN device is located on the network side, and the operator provides VPN services for the user. The user equipment does not need to be aware of the VPN, as long as it is connected to the PE device provided by the operator. .

As shown in Figure 1, the BGP/MPLS VPN model includes three components: CE, PE and P router.

CE (Custom Edge) equipment: It is an integral part of the user network, and has an interface directly connected to the service provider, usually a router. CE does not "perceive" the existence of VPN.

PE (Provider Edge) router: the operator's edge router, which is the edge device of the operator's network and is directly connected to the user's CE. In an MPLS network, all VPN processing occurs on PE routers.

P (Provider) router: the backbone router in the carrier network, not directly connected to CE. The P router needs to have the basic MPLS forwarding capability.

The division of CE and PE is mainly based on the management scope of operators and users. CE and PE are the boundaries of the management scope of the two.

CE and PE use E-BGP or IGP routing protocol to exchange routing information, and static routing can also be used. CE does not have to support MPLS or be aware of VPN.

1. Publish VPN routing information through BGP

PEs exchange routes through IBGP sessions after obtaining routing information from CEs. After the Ingress PE node receives the VPN routing information (carrying the inner layer label of the private network) sent by the egress PE, it checks whether there is a tunnel from the ingress PE to the egress PE. If so, the forwarding item of the private network route can be generated

2. Forwarding of VPN packets

VPN message forwarding uses two layers of labels (this is the case when LSP is used as the tunnel, and if GRE is used as the outer layer tunnel, only the inner layer label is required). The first layer (outer layer) label is exchanged inside the backbone network, which represents an LSP from the PE to the peer PE. VPN packets can reach the peer PE along the LSP by using this layer of labels. The second layer (inner layer) label is used when reaching the CE from the peer PE. The inner layer label indicates which Site the packet reaches, or more specifically, which CE it reaches. In this way, according to the inner label, the interface for forwarding the packet can be found.

1. L2VPN

There are three implementation methods of MPLS L2VPN: CCC method, Martini method, and Kompella method, each of which has its own characteristics.

CCC mode:

The CCC (Circuit Cross Connect) method can configure a transparent connection between two PE-CE connections through the network management or command line. In this way, the source CE group can be sent to the destination CE, and at most only the layer 2 address is changed without any other processing. When packets are forwarded in this way, there is only one layer of labels and no tunnel is required.

Kompella mode:

This type of Layer 2 VPN is very similar to the Layer 3 BGP/MPLS VPN defined by RFC2547, so it is easy for those who are accustomed to RFC2547 to understand this type of Layer 2 VPN.

Like BGP/MPLS VPN, each PE can automatically discover each site of Layer 2 VPN through the established IBGP session. Label blocks have been assigned to each CE at the beginning, and the labels required for each connection can be automatically calculated through a specific algorithm. Layer 2 VPN information is transmitted between PEs through extended BGP. Accordingly, forwarding is realized through MPLS LSP

Martini mode:

This method follows the draft draft-martini-12circuit-trans-mpls, and uses LDP as the signaling for transmitting VC information. Compared with the Kompella method, its configuration and implementation are relatively simple. There is no concept of VPN, and it only provides the connectivity of Layer 2 links, which is easy to understand.

In the Martini mode, LDP remote sessions will be established between PEs, and PEs will allocate a VC label for each connection between CEs. The Layer 2 VPN information will carry the VC label and be forwarded to the peer PE of the remote session through the LSP established by LDP. In this way, a VCLSP is actually established on a common LSP.

Contents of the invention

The purpose of this patent is to provide a method for implementing VPN in MPLS, which can flexibly process and forward data packets, and effectively utilize the existing resources of the system.

A kind of realization method of MPLS VPN is characterized in that comprising the following steps:

a. Configure the policy to the device;

b. The egress VPN edge device (Egress PE) sends relevant information to the ingress VPN edge device (Ingress PE);

c. The Ingress PE matches the received route with the policy. If successful, enter step d, otherwise discard it;

d. Create policy routing table items and save them in policy routing;

e. Find the outer tunnel according to the policy, and forward the packet to the Exgress PE side.

In said step e, if the search for the outer tunnel fails, a step of driving signaling to establish the outer tunnel is also included as required.

Described MPLS VPN is BGP/MPLS VPN, and the policy in the described step a refers to according to the 5-tuple information of IP message, the priority of IP message, the incoming interface information of message is carried out to data message Classify and specify rules for data forwarding using the outer tunnel.

The strategic routing entry in the step d is to modify the destination address of the 5-tuple information in the classification rule to the intersection of the destination address of the route and the destination address in the IP packet 5-tuple information in the classification rule, and the modified Classification rules and corresponding outer tunnel selection rules generate policy routing.

In the step e, the LSP is used as the outer layer tunnel.

The forwarding process uses two layers of labels, the first layer of labels is exchanged inside the backbone network, and the second layer of labels is exchanged between the peer PE and CE.

Described MPLS VPN is L2VPN, and the strategy in the described step a refers to classifying data packets according to information such as the incoming interface of the message, the QOS field in the link layer message header and specifying data forwarding using Rules for the outer tunnel.

In the step c, the matching content is to match the incoming interface in the classification rule with the configured VC of the L2VPN.

The policy routing entry in step d is a policy routing entry generated from the rules in the original policy.

In the step e, use GRE or IPSEC as the outer layer tunnel.

In the forwarding process described above, the establishment of VPN message forwarding uses a layer of labels.

Adopting the VPN implementation method of the present invention, since the outer layer can have many tunnels, the present invention can select tunnels according to the characteristics of the business, so as to ensure that the quality of service of the business can meet the requirements of customers, and the traffic work will not be limited to the business of the operator at the same time. At the same time, it can support the customer's business. In addition, according to the needs of the private network business, it can dynamically establish the LSP of MPLS TE to meet the needs of users.

Description of drawings

Fig. 1 is in prior art, BGP/MPLS model;

Figure 2 is a flow chart of the present invention.

Detailed ways

The specific implementation manners of the present invention will be described below in conjunction with the accompanying drawings. (Please give a specific routing policy content, and an established policy routing table, just give a few symbolic entries.)

Policy-Based Routing (PBR: Policy-Based Routing) is to specify the outgoing interface or next hop of the packet by matching the characteristics of the packet (such as the incoming interface, the source address of the packet, the destination address, etc.). If the match is successful, the packet will be forwarded according to the outbound interface or next hop specified by the policy routing, and the ordinary routing table will not be queried. The present invention utilizes this characteristic of policy routing to select the outer layer tunnel. As shown in Figure 2, it is a flowchart of the present invention, as can be seen from the figure, the present invention comprises the following steps:

a. Configure the policy to the device through the command line or the network management system. The device may be a router, LANSWITCH and other devices in the communication device. The strategy for BGP/MPLS VPN is to classify packets according to the 5-tuple information of IP packets, the priority of IP packets, and the incoming interface of packets. The strategy for L2VPN (Layer 2 VPN) is to classify packets according to The incoming interface of the file, the QoS field in the link layer header (such as the 802.1p bit of the Ethernet frame header), can also include VLAN ID, PVC and other information to classify the message, and each type of message can be defined to select the outer layer tunnel the rule of.

By establishing the above classification for messages with different forwarding requirements, different services can be used according to different service requirements, which increases the flexibility of the system in processing messages.

For example, a policy routing entry can include the following:

Packet matching condition: the source address of the packet is 10.1.1.2

Forwarding rules: Specify the outbound interface of the packet as tunnell (tunnel interface created by MPLS TE), etc.

b. Egress PE sends private network VPN (BGP/MPLS VPN or L2VPN) information (local VPN routing information for BGP/MPLSVPN) to ingress PE through BGP/LDP for matching when data packets are forwarded.

c. The ingress matches each piece of information received with all policies one by one. For MPLSBGP/VPN, it mainly compares the destination address of the received route with the destination address of the 5-tuple information of the IP packet in the policy classification rule. For L2VPN, use the VLAN ID/PVC in the classification rule or the inbound interface and the L2VPN Configure VC matching.

d. After the packet of each VPN arrives at the PE, the PE matches the packet with all policy routes one by one. If the match is successful, create a policy routing entry and save the entry to the policy routing. For BGP/MPLS VPN, modify the destination address of the 5-tuple information in the classification rule to the destination address of the route and the IP in the classification rule. The intersection of the destination address in the message 5-tuple information generates special policy routing entries one by one from the modified classification rules and the corresponding outer tunnel selection rules, and stores them in the policy routing. For L2VPN, the rules in the policy are not modified in any way to generate special policy routing entries and save them in the policy routing.

e. Find the outer tunnel according to the policy, and forward the message to the Exgress PE side,

If the match is successful, it also checks whether the tunnel exists according to the rules corresponding to the classification results.

If the result of the search is that the outer tunnel does not exist, signaling may be driven to establish the tunnel as required.

For forwarding the message, the forwarding processing takes LSP (including common LSP and LSP established by TE) as the outer layer tunnel: the two-layer label mode is used for forwarding the established VPN message. The first layer (outer layer) label is exchanged inside the backbone network, which represents an LSP from the PE to the peer PE. VPN packets can reach the peer PE along the LSP by using this layer of labels. The second layer (inner layer) label is used when reaching the CE from the peer PE. The inner layer label indicates which Site the packet reaches, or more specifically, which CE it reaches. In this way, according to the inner label, the interface for forwarding the packet can be found.

For the forwarding processing of GRE, IPSEC, etc. (non-LSP tunnels) as outer tunnels: only one layer of labels is used for forwarding VPN packets. Since there is already a tunnel between the Ingress PE and the egress PE, the ingress PE only needs to send the MPLS packets marked with the inner layer label through the tunnel interface to reach the egree PE. The processing of forwarding on the egress PE remains unchanged.

A typical application is that because the voice service (VOIP) has relatively strict requirements on bandwidth and delay, the current VPN will transmit the voice and ordinary data packets through the same tunnel without distinguishing them. Service requirements for voice cannot be guaranteed. With the VPN implementation method of the present invention, the voice service can be transmitted through the LSP established by TE with guaranteed bandwidth and time delay, and ordinary data messages can be transmitted through GRE or common LSP. The quality of service requirements of voice services can be guaranteed.

Adopting the VPN implementation method of the present invention, since the outer layer can have many tunnels, the present invention can select tunnels according to the characteristics of the business, so as to ensure that the quality of service of the business can meet the requirements of customers, and the traffic work will not be limited to the business of the operator at the same time. At the same time, it can support the customer's business. In addition, according to the needs of the private network business, it can dynamically establish the LSP of MPLS TE to meet the needs of users.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (10)

1, a kind of implementation method of MPLS VPN is characterized in that may further comprise the steps:

A, with policy configurations to inlet Virtual Private Network edge device VPN Ingress PE;

B, outlet Virtual Private Network edge side equipment VPN Egress PE send to inlet Virtual Private Network edge side equipment with local virtual private network information;

C, inlet Virtual Private Network edge side equipment mate route and the strategy of receiving, if success enters steps d, otherwise abandons;

D, set up tactful route table items and be saved in the tactful route;

E, search outer layer tunnel,,, then need to drive signaling and set up outer layer tunnel if do not find outer layer tunnel if success is forwarded to outlet Virtual Private Network edge side equipment side with message according to strategy.

2, the implementation method of a kind of MPLS VPN as claimed in claim 1, it is characterized in that described MPLS VPN is Border Gateway Protocol MPLS VPN BGP/MPLS VPN, strategy among the described step a, be meant 5 tuple information according to the IP message, IP priority of messages, the incoming interface information of message are classified to the data message and specific data is transmitted the rule of using outer layer tunnel.

3, the implementation method of a kind of MPLS VPN as claimed in claim 2, it is characterized in that the tactful route table items in the described steps d, be that destination address with 5 tuple information of IP message in the data message classifying rules is revised as in route destination address and the data message classifying rules common factor of destination address, amended data message classifying rules and corresponding outer layer tunnel selective rule generation strategy route in IP message 5 tuple information.

4, the implementation method of a kind of MPLS VPN as claimed in claim 3 is characterized in that among the described step e that usage flag switching path LSP is as outer layer tunnel.

5, the implementation method of a kind of MPLS VPN as claimed in claim 4, it is characterized in that the two-layer label mode of described forwarding processing use, the ground floor label exchanges in backbone network inside, and second layer label exchanges between user network edge router CE at opposite end backbone network edge router PE.

6, the implementation method of a kind of MPLS VPN as claimed in claim 1, it is characterized in that described MPLS VPN is Layer 2 virtual private network L2VPN, strategy among the described step a is meant that service quality QoS field information in incoming interface according to message, the link layer newspaper heading is classified to the data message and specific data is transmitted the rule of using outer layer tunnel.

7, the implementation method of a kind of MPLS VPN as claimed in claim 6 is characterized in that among the described step c, and the content of coupling is that the configuration virtual container VC with incoming interface in the classifying rules and Layer 2 virtual private network mates.

8, the implementation method of a kind of MPLS VPN as claimed in claim 7 is characterized in that tactful route table items in the described steps d, is the tactful route table items that generates with the rule in the step a strategy.

9, the implementation method of a kind of MPLS VPN as claimed in claim 8 is characterized in that among the described step e, uses generic route encapsulation GRE or IP Security Protocol IPSEC as outer layer tunnel.

10, the implementation method of a kind of MPLS VPN as claimed in claim 9 is characterized in that in the described forwarding processing, sets up the virtual private network packet and transmits one deck label mode of using.