CN1260916C - Method for realizing virtual specific network in ATM network - Google Patents

Abstract

The invention relates to a method for realizing VPN on an ATM PVC (permanent virtual link) on an Ethernet three-layer switch device. A method for realizing VPN on an ATM network, characterized in that a message identifier for identifying the VLAN where the message is located is added to the transmitted message, and at the receiving message side, the VLAN where the message is identified is identified by the message identifier , to restore the message so that different VLANs can share the same ATM transmission link. The invention expands the application of RFC1483 in the Ethernet, especially for the networking application of the VLAN widely used in the current three-layer switch, and brings great convenience.

Description

A Method of Realizing Virtual Private Network on ATM Network

technical field

The invention relates to the field of network device protocol realization, in particular to a method for realizing a virtual private network (VPN) on an ATM network.

technical background

At present, on the interface cards of related switching equipment such as switches, three-layer switches, and routers, most of them provide Ethernet interfaces, such as 10M/100M electrical ports, Gigabit (GIGABIT) electrical ports and optical ports, and 10GE optical ports. With the wide application of three-layer switches in the network, it is required that the Ethernet switches used in the aggregation layer and the backbone layer can have different interface types to meet the requirements of different access devices in the current network environment. At present, ATM switches are widely used in the network. Therefore, providing ATM interfaces on switching devices such as layer 3 switches and routers can use ATM networks to realize interconnection with WANs. It is the current way to improve the competitiveness of switching devices. It is of great significance to reduce the network operation cost and expand the operation scope of the metropolitan area network.

As shown in Figure 1, it is the connection schematic diagram that utilizes ATM to realize VPN at present, mainly utilizes ATM permanent virtual circuit (PVC) to realize VPN, promptly in ATM network, according to VPN user, creates a specific PVC connection; Utilizes ATM PVC to bear the weight of Specific data frame: on the ingress VPN edge device (ingress pe) side, the user uses a specific PVC to correspond to the forwarding peer (fec) of the VPN user, and then encapsulates the message into an ATM cell and forwards it to the ATM network; In the p device, only ordinary ATM forwarding is carried out; in the egress PE, according to the PVC of the cell, the message is converted into a specific VPN user message, and then the message is forwarded by the ce device to specified user.

The characteristics of this method are: a VPN user corresponds to a PVC link, and the identification of the user is determined by the identification of the PVC; since each user maps a specific PVC chain in the ATM network, and uses IP and PVC to map, it is not Very convenient, Ethernet cannot be transparently transmitted, and it is troublesome to assemble packets.

In this way, PVC links are used to ensure that specific VPN user data frames are not disturbed by the network, and user data information is protected; but PVC resources are wasted; user identification is not very good; and the support for Ethernet is not good enough, ATM needs to be implemented. Remapping of PVCs to VPN User Peers (FECs).

Contents of the invention

Purpose of the present invention is exactly in order to solve a kind of method that utilizes ATM interface to realize VPN on switching equipment at present.

The scheme of the present invention is as follows:

A kind of method for realizing VPN on ATM network, it is characterized in that in the message that transmits, add the message identification of the place VLAN of a mark message, at the receiving message side, identify the VLAN where the message is by the message label , to restore the message so that different VLANs can share the same ATM transmission link.

The described method for realizing VPN on the ATM network specifically comprises the following steps:

A, in the data message, add the message identification of the place VLAN of a mark message, and described data message is sent in the ATM network;

B, ATM network searches the mapping table according to the message identifier carried, and finds the corresponding PVC cross connection;

c. Forward the message to the corresponding VLAN;

d. Find the label operation corresponding to the mapping table, and perform the operation to restore the message, so that different VLANs can share the same ATM transmission link.

The described method for realizing VPN on the ATM network, in the step b, also includes a step of adding a two-layer or multi-layer label, and the two-layer or multi-layer label is used to further identify the VLAN of the protocol message, corresponding A step of processing the two or more layers of labels is also included before step d.

In the method for realizing VPN on the ATM network, before step d, the processing of the layer-2 label is to delete the label.

In the method for realizing VPN on the ATM network, before the step d, the processing of the layer-2 label is to perform a null operation on the label.

In the method for realizing VPN on the ATM network, the step of sending the data message to the ATM network is completed by a three-layer switch.

The message is in the format specified by 802.1q.

The present invention can make full use of the mapping between ATM PVC and Ethernet 802.1Q data frame VLAN TAG to realize the identification of VPN users and ensure that different users realize safe and transparent transmission of data on the basis of fewer PVCs.

Description of drawings

Fig. 1 is the realization mode of VPN in the prior art;

Fig. 2 is a flow chart of the present invention;

Fig. 3 is the forwarding schematic diagram of message of the present invention;

FIG. 4 is a schematic diagram of forwarding in a transparent transmission mode;

FIG. 5 is a schematic diagram of message forwarding according to an embodiment of the present invention;

FIG. 6 is a flow chart of sending messages according to an embodiment of the present invention;

Fig. 7 is a message receiving process of the embodiment of the present invention.

Detailed ways

The specific implementation manners of the present invention will be described below in conjunction with the accompanying drawings.

The purpose of the present invention is exactly in order to solve a kind of method that utilizes ATM interface to realize VPN on switching equipment. It can make full use of the mapping between ATM PVC and Ethernet 802.1Q data frame VLAN TAG to realize the identification of VPN users and ensure the safe and transparent transmission of data for different users on the basis of fewer PVCs. This mapping is mainly the mapping between the PVC (vpi/vci --- vcc index) of ATM and the VLAN TAG of 802.1q; so just can make full use of PVC to carry out the link of VPN for multiple VLANs.

In the present invention, a message identifier identifying the VLAN where the message is located is added to the transmitted message, and at the side of receiving the message, the VLAN where the message is located is identified by the message ID, and the message is restored so that different VLANs Can share the transmission link of the same ATM.

As shown in Table 1, it is a message used by the present invention. As can be seen from the table, the present invention has added an identification TAG. According to the proposal of rfc1483, our invention has expanded this, and can utilize the ATM transparent transmission band TAG 802.1q protocol packets; 0xaa-aa-03 0x00-80-c2 0x00-01 or 0x00-02 DEST-MAC-ADDRESS SRC-MAC-ADDR VLAN-TAG1 VLAN-TAGn ethernet frame LANFCS

Table I

The part with TAG indicates that it is an expanded part. In this way, VLAN TAG can be used to distinguish different VLANs in the ATM PVC, ensuring that different VLANs are shared in the same ATM transmission link, and realizing transparent data transmission of different VLANs.

As shown in Figure 2, it is the flow chart of the present invention to realize virtual private network method on ATM, and Fig. 3 is a network diagram that realizes virtual private network on ATM.

The specific implementation manner of the present invention may comprise the following steps:

a. Send the data message to the ATM network;

This step can be completed through various network switching devices, such as a router, a switch, or a layer-3 switch that is currently widely used, with an ATM interface, and can support current general VPN services. It will be all right.

B, ATM network searches the mapping table according to the message identifier carried, and finds the corresponding PVC cross connection;

In this step, a step of adding a two-layer or multi-layer label can also be included, and the two-layer or multi-layer label is used to further identify the VLAN of the protocol message. In fact, in the table, in the corresponding Ethernet data frame, Add one or more layers of VLAN TAGs; for example, TAG7 in Figure 3, the reason why multiple TAGs are used is to enable dual/or multiple TAGs to be carried, which is very important for solving the space limitation of the number of tags, because 802.1 The qTAG is only 4k in size, and the problem of the size of the TAG space can be solved by carrying multiple TAGs.

c. Forward the message to the corresponding VLAN;

d. Find the label operation corresponding to the mapping table, and perform the operation to restore the message.

After the data frame is reassembled, the VPI/VCI is used to form an index to obtain the VLAN TAG; and then obtain the processing operation on the TAG.

The step of processing two or more layers of labels included in step d is an operation corresponding to adding two or more layers of labels in step b. Among them, the above three operations are included: adding TAG, deleting TAG, and empty operation. The add operation is to add a TAG identifier to the data; the delete operation is to delete the previously added identifier for data restoration and reorganization; the empty operation is to directly transparently transmit the data without any processing on the second-layer or multi-layer tags.

The significance of this transparent transmission is to completely receive the VLAN tag input from the user equipment, without any modification, and directly transparently transmit it. This protects the user's own private configuration. In actual use, users can divide several VLANs according to their own business characteristics, and then use this empty operation to transparently transmit to remote nodes, which ensures the reliability of communication and reduces the complexity of configuration. Examples are as follows:

As shown in Figure 4, on the switch on the user side, as long as the same VLAN is configured (for example, the finance department/production department/president office each have the same VLAN), configure the In Beijing, Shanghai) you can communicate directly. This is in line with the basic attribute of users defining their own services in VPN, using the public network (ATM network) for direct transmission, and after reaching the peer end, the user-side switch (pe or ce) performs corresponding forwarding.

The data packets mentioned above are in the format specified by 802.1q.

In the following, the present invention will be further described and analyzed in conjunction with our realization on the three-layer switch.

Fig. 5 is the processing functional module schematic diagram of a message forwarding of the embodiment of the present invention; Mainly contain the physical interface module of ATM, the ATM physical layer processing module (FRAMER module), ATM reorganizes segmentation and forwarding module (ATM forwarding module and SAR) , forwarding chip, main processing of the present invention all realizes in ATM forwarding logic and SAR (Segment and Reassemble, segmentation and reassembly).

Since the current three-layer switch forwarding chip (ASIC) is currently mainly concentrated on the Ethernet interface, many WAN interfaces cannot be provided. Therefore, in order to realize the ATM interface, as shown in Figure 5, this embodiment adopts the following forwarding method:

In the design, in order to realize the addition/deletion/null operation of the VLANTAG of the TAG in the LLC/SNAP frame of the AAL5 of ATM, we have done the following work on the forwarding process, the steps are as follows:

We call the operation that the message is sent from the forwarding chip to the ATM physical interface downlink operation; the operation from the ATM physical interface to the forwarding chip is called the uplink operation, then the message forwarding can include the following steps:

a. The Ethernet data message is forwarded to the ATM forwarding logic through the forwarding chip;

In the downlink, we require the forwarding chip to be able to forward the Ethernet data frame carrying the VLAN TAG to the ATM forwarding logic through the GMII bus. This implementation is relatively easy for most forwarding chips, for example as follows:

Use the ATM port alone as a VLAN 3, and configure it in Huawei QUIDWAY series switches as follows:

<CONFIG>#>VLAN 3 #(Create VLAN 3)

<VLAN 3>#SWITCH PORT ATM3/0/1 (this VLAN contains port ATM 3/0/1)

Then use the ATM 3/0/1 port as a VLAN trunk port. When setting up other VLANs, when it is necessary to use the ATM link to communicate with the remote PVC, use ATM 3/0/1 as a port member of the VLAN. Examples are as follows:

<CONFIG>#>VLAN 1000#<create VLAN 1000>

<VLAN 1000>##>switch port gi2/0/1 gi2/0/3 ATM3/0/1 #<use gi2/0/1gi2/0/3, ATM 3/0/1 as port members of VLAN 1000> ;

After setting, use the MAC address learning of the chip to forward the message to the ATM port for forwarding.

B. In the ATM forwarding logic, according to the message identification carried, search the mapping table, and find the corresponding PVC cross connection;

In the ATM forwarding logic, we need to look up the VLAN-TAG---PVC mapping table according to the carried VLAN-TAG to find the corresponding VCC (PVC cross-connect); It is the add/delete and null operations mentioned earlier. in:

Adding TAG----is to add one or more layers of VLANTAG to the corresponding Ethernet data frame in the table; in this way, double/or multiple TAG can be carried, which is very important for solving the space limitation of the number of tags Significance, because the 802.1qTAG is only 4k in size, and the problem of the size of the TAG space can be solved by carrying multiple TAGs. The networking application is shown in Figure 2;

Delete TAG-----Under this interface, delete the label, or remove the label in the network without label support, and transparently transmit the Ethernet data frame.

Null operation ------Under this interface, carry out the null operation of the label, so that the 802.1Q data frame is transparently transmitted. Realize that one PVC can correspond to multiple VLANs. Especially for the application of enterprise network, it is very convenient and flexible.

c. Forward the message to the corresponding VLAN through the ATM network;

d. Find the label operation corresponding to the mapping table, and perform the operation to restore the message.

FIG. 6 and FIG. 7 are flowcharts of this embodiment, wherein FIG. 6 is a detailed description of the downlink operation in FIG. 5 , and FIG. 7 is a detailed description of the uplink operation in FIG. 5 . As can be seen from the flow chart, in the uplink of this embodiment, after the ATM SAR unit completes the reorganization, the data frame forms an index with VPI/VCI to obtain the VLAN TAG; then obtain the operations on the TAG, including the above three operations: Add TAG, delete TAG, empty operation.

The processing flow in Figure 6 is:

a. The forwarding chip in the downlink direction receives Ethernet packets from the FE/GE port;

B. The forwarding chip inquires according to the destination MAC of the Ethernet message, and finds that the message should be forwarded to the ATM port, and then forwards the message to the port;

After receiving the message, the c.ATM forwarding module analyzes the VLAN of the message, and obtains the VPI/VCI corresponding to the VLAN with the VLAN look-up table mapping;

d. Use the found VPI/VCI to check the attributes of the data flow, and obtain the operation of adding VLAN TAG7 at the ingress of the data flow;

E.ATM forwarding module just adds VLAN TAG7 in the original message according to the operation indication and VLAN TAG7 that d step obtains;

f. The ATM SAR module will segment the message after the VLAN TAG7 has been added; the ATM forwarding module will forward the fragmented ATM cell to the ATM interface module through the FRAMER, and then send it to the ATM network.

The processing flow in Figure 7 is:

a. The ATM interface module receives the ATM cell, and obtains the Ethernet message in it after performing ATM reassembly in the ATM SAR part;

b. According to the VPI/VCI look-up table where the message is located, the attribute of obtaining the data flow is to delete the VLAN TAG7 in the Ethernet message at the exit;

c. Delete the VLAN TAG7 in the Ethernet message according to the operation instructions;

d. forward the Ethernet message that deletes VLAN TAG7 to the forwarding chip;

e. The forwarding chip performs forwarding processing according to the destination MAC of the Ethernet message, and forwards it to the corresponding FE/GE port.

In terms of software implementation, we have carried out the following design:

1) We divide the software's configuration of ATM PVC and Ethernet VLAN into two configuration planes. ATM plane and Ethernet VLAN plane.

On the ATM configuration plane, we configure PVCs separately; on the VLAN configuration plane, we also configure VLANs separately, and then we map VLANs and PVCs, and configure the mapping results into the PVC-VLAN TAG table.

The implementation method of the present invention expands the application of RFC1483 in Ethernet, especially for the networking application of VLAN widely used in the current three-layer switch, it brings great convenience, and it makes the ATM interface not only applicable to router equipment or ATM It can also be used on the switch equipment, and it can also be used on the three-layer switch, which expands the application range of the three-layer switch. It has great practical significance for using the ATM interface as the WAN interface to realize the interconnection between enterprise VPNs.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (6)

1. method that realizes VPN on atm network is characterized in that may further comprise the steps:

A, in data message, add the message identification of a sign message place VLAN, and described data message is sent in the atm network;

B, atm network are searched mapping table according to entrained message identification, find corresponding PVC cross-join;

C, receiving the message side, discern this message place VLAN by this message identification, message is forwarded to corresponding VLAN;

D, find the tag operational of mapping table correspondence, the line operate of going forward side by side, the reduction message, thus realize that different VLAN can share the transmission link of same ATM.

2. the method that on atm network, realizes VPN as claimed in claim 1, it is characterized in that among the described step b, also comprise a step of adding two layers or multilayer label, described two layers or multilayer label is used for the VLAN of further identity protocol message, the corresponding step that also comprised described two layers or multilayer label of processing before steps d.

3. the method that realizes VPN on atm network as claimed in claim 2 is characterized in that before the described steps d, to the processing of these two layers of labels, is with this label deletion.

4. the method that realizes VPN on atm network as claimed in claim 2 is characterized in that before the described steps d, to the processing of these two layers of labels, is that this label is carried out do-nothing operation.

5. as any described method that on atm network, realizes VPN of claim 1-4, it is characterized in that described data message being sent to the step of atm network, finish by three-tier switch.

6. as any described method that on atm network, realizes VPN of claim 1-4, it is characterized in that described message, be the form of 802.1q regulation.