CN1266887C - Virtual switch for supplying virtual LAN service and method - Google Patents

Abstract

A virtual switch and method for providing virtual private local area network segment (VPLS) services, the virtual switch includes: an ATM interface module, an Ethernet interface module and an Ethernet switch module; Handled Layer 3 Tunneling Interface Module. The method of using a virtual switch (VS) to provide a virtual private local area network (VPLS) service across an IP WAN is to use a layer-3 tunneling protocol to establish an IP tunnel between different virtual switches, and to provide Ethernet packet data as the load of an IP packet A channel for transparent transmission; and encapsulates the Ethernet packet data that needs to be transmitted with the third-layer tunnel protocol. That is, the Ethernet packet is encapsulated in the IP message for forwarding, and the interconnection of the virtual switch across the IP network is completed. The invention enables the virtual switch to provide virtual private local area network segment services under the network environments of ATM, Ethernet and IP, and enhances the networking capability and application range of the virtual switch.

Description

Virtual switch and method for providing virtual local area network segment services

technical field

The invention relates to a virtual switch and a method for providing virtual local area network segment services, and belongs to the technical field of broadband networks in data communication.

Background technique

With the rapid development of broadband networks, modern enterprises and government agencies need to interconnect computer networks in multiple office locations. The distance between these office locations may range from one or two kilometers to several thousand kilometers, and the number of information points (that is, the number of computers connected to the network) at each location ranges from a few to thousands. A typical large company needs to form a computer network all over the country, and the number of computers connected to the network reaches tens of thousands. It is obviously uneconomical and unreasonable for enterprises to lay lines by themselves and build their own dedicated networks. Usually, the enterprise purchases the virtual private network (VPN, virtual private network) service provided by the Internet Service Provider (ISP, Internet Service Provider) to form the enterprise's own private network.

Currently, virtual private network VPNs include four types:

(1) Virtual Private Dial Networks (VPDN, Virtual Private Dial Networks): Users use the dial-up network to access the enterprise data center, each user obtains a private address from the enterprise data center, but user data can be transmitted across the public data network.

(2) Virtual Lease Line (VLL, Virtual Lease Line): The simplest VPN type, a leased line is simulated through an IP tunnel between the two ends.

(3) Virtual Private Routed Networks (VPRN, Virtual Private Routed Networks): Enterprises use public data networks to build their own private enterprise networks, and users can freely plan addresses, routing strategies, and security mechanisms between branches of the enterprise.

(4) Virtual Private LAN Segment (VPLS, Virtual Private LAN Segment): A LAN simulated by using the Internet.

A virtual switch (VS, virtual switch) is a functional entity generated through configuration on a network device, and it can complete the function of an Ethernet switch. A virtual switch is a technical means to realize a virtual private network (VPN). Multiple virtual switches can be divided on one network device, and each virtual switch can implement a virtual private local area network segment (VPLS) service. At present, the virtual private network system realized by the virtual switch can only be interconnected across ATM and Ethernet, and cannot be interconnected across the IP network.

Each virtual switch corresponds to a group of independent data tables on a network device, and they include a virtual switch access channel table, a virtual switch forwarding control table, and a virtual switch address switching table. The access channel table stores the information of the data forwarding channel belonging to the virtual switch, and the information is also called the port of the virtual switch. The forwarding control table stores a control flag indicating whether a port of a virtual switch can communicate with other ports of the same virtual switch. The address exchange table stores the correspondence between Ethernet addresses and virtual switch ports.

The network device determines the virtual switch to process the data according to the port information of the received data. In the virtual switch, check the "address exchange table" according to the destination address carried by the Ethernet packet header to obtain the outgoing port information. If the outbound port can communicate with the inbound port, forward the data packet to the outbound port; if there is no matching outbound port address in the lookup table, forward the packet to all other ports of the virtual switch that can communicate with the inbound port. Each virtual switch has independent Ethernet address learning and address elimination functions. The Ethernet addresses used by each virtual switch and shared system resources are isolated from each other. Any virtual switch can not be affected by other virtual switches, ensuring the security of each virtual private network data.

The virtual switch is initially used to provide virtual private LAN segment services on ATM equipment, so the virtual switch system only has the ATM access function initially. Later, the virtual switch added the function of Ethernet access. The existing virtual switch system is composed of ATM interface module, Ethernet interface module and Ethernet switching module. For ATM access, user data is encapsulated by 1483B protocol and input to the ATM interface module, the ATM interface module removes the 1483B encapsulation of the data packet, and takes out the Ethernet packet data and hands it to the Ethernet switch module for processing. For Ethernet access, user data is encapsulated and input to the Ethernet interface module according to the 802.Q specification. The Ethernet interface module removes the 802.Q encapsulation, and takes out the Ethernet packet data and hands it to the Ethernet switch module for processing. When outputting data, if the output port is an ATM port, the Ethernet switch module sends the Ethernet packet data to the ATM interface module for 1483B encapsulation; if the output port is an Ethernet port, the Ethernet switch module sends the Ethernet packet data to the Ethernet interface module It is sent out after packaging according to the 802.Q specification.

At present, when using a virtual switch to set up a virtual private LAN segment, if the two branches of the user are respectively connected to the virtual switch located on two different network devices, then the two virtual switches can only span the ATM network or Ethernet network. network to achieve interconnection. Because the IP network searches for routes based on the third-layer information (ie IP address) when forwarding data. Therefore, the data packets sent from the existing virtual switch system cannot be forwarded on the IP network after 1483B or 802.Q encapsulation. Even if the data packet encapsulates an IP packet, and the IP address is a private network address within the enterprise, it cannot be correctly forwarded by devices on the public network.

However, due to the development of network technology, IP technology gradually occupies a dominant position, and the application and distribution range of IP network far exceeds that of ATM network. The defect that the data packets sent by the existing virtual switch cannot be forwarded on the IP network greatly limits the development and application of virtual private network (VPN), and has become a market application bottleneck that urgently needs to be solved and overcome by people in the industry.

Contents of the invention

The purpose of the present invention is to provide a virtual switch that can overcome the defects of the prior art and provide virtual local area network segment (VPLS) services, so as to adapt to the current communication environment including the coexistence of multiple networks such as ATM network, Ethernet and IP network.

Another object of the present invention is to provide a method for providing virtual private local area network segment (VPLS) service by using a virtual switch (VS).

The purpose of the present invention is achieved like this: a kind of virtual switch that provides virtual local area network segment (VPLS) business, this virtual switch includes: ATM interface module, Ethernet interface module and Ethernet exchange module; It is characterized in that: this virtual switch is also set There is a layer-3 tunnel interface module connected to the Ethernet switch module that completes layer-3 tunnel protocol processing. The layer-3 tunnel interface module sets and maintains: a layer-3 tunnel encapsulation table and a key-virtual switch port binding table .

The layer-3 tunnel encapsulation table stores the key value of the local end of the tunnel, the IP address of the opposite end of the tunnel, and the key value of the opposite end of the tunnel.

The key-virtual switch port binding table stores the key value of this section of the third-layer tunnel, and the virtual switch sequence number and virtual switch port sequence number bound thereto; the key value of this section of the third-layer tunnel There is a one-to-one correspondence with the serial number of the virtual switch bound to it and the serial number of its port.

The three-layer tunnel interface module terminates the third-layer tunnel protocol for the input data, takes out the Ethernet packet transmitted by the tunnel, and sends it to the Ethernet switch module for switching; , the Ethernet packet is tunnel-encapsulated, and then handed over to the IP forwarding module for forwarding.

The Ethernet switching module is the core of the virtual switch system, and is used to complete virtual switch table item management and Ethernet packet switching functions.

The Ethernet switching module has a set of independent data tables corresponding to the virtual switch. When receiving data from the ATM, Ethernet or Layer 3 tunnel interface module, it searches for the corresponding virtual switch table according to the port information carried in the data, and then according to The virtual switch table records information for looking up port forwarding.

Another object of the invention of the present invention is achieved like this: a kind of method utilizing virtual switch (VS) to provide virtual private local area segment (VPLS) service, is characterized in that:

(1) Use the third-layer tunneling protocol to establish the third-layer tunnel between different virtual switches, and provide a channel for transparently transmitting the Ethernet packet data as the load of the IP data packet;

(2) Carry out layer-3 tunnel protocol encapsulation for the Ethernet packet data to be transmitted, and transmit through the layer-3 tunnel.

Described step (2) further comprises:

(21) The local network device takes out the Ethernet packet according to the incoming port information of the received data, and gives it to the local virtual switch;

(22) After the local virtual switch receives the Ethernet packet, it switches the packet to the output port corresponding to the third-layer tunnel according to the destination Ethernet address;

(23) the three-layer tunnel interface module obtains the third-layer tunneling protocol encapsulation information according to the output port number, then adds the third-layer tunnel identification-general routing encapsulation GRE tunnel head and IP head to this Ethernet packet according to the third-layer tunneling protocol regulation, And sent through the third layer tunnel;

(24) The Layer 3 tunnel forwarding module of the destination network device receives the IP message sent through the Layer 3 tunnel, determines the destination virtual switch according to the Layer 3 tunnel identifier and IP header, and takes out the Ethernet packet and hands it to the destination virtual switch. switch;

(25) The destination virtual switch sends the Ethernet packet to the destination network device.

The third layer tunneling protocol used in the establishment of the IP tunnel includes: Generic Routing Encapsulation (GRE, Generic Routing Encapsulation) tunneling protocol, Multiprotocol Label Switching (MPLS, MultiprotocolLabel Switching) technology and Internet Protocol Security (IPsec, Internet Protocol Security) technology.

The third layer tunnel is identified as a Generic Routing Encapsulation (GRE) tunnel header.

The IP header contains the IP address of the Layer 3 tunnel interface module at the opposite end of the Layer 3 tunnel, and the Layer 3 tunnel identifier is provided with a checksum field and a key field, and the checksum field and the key field must be Set to 1.

The checksum domain is used to calculate the checksum for the third-layer tunnel identifier and the Ethernet packet data, and the key value uniquely indicating the third-layer tunnel is set in the described key domain, and the key value is used for Uniquely determine the sequence number of the virtual switch bound to the tunnel and the port sequence number of the virtual switch.

The key domain can carry verification information used for verification during the processing of the layer-3 tunnel interface module, so as to prevent external attacks on the virtual private local area network segment.

The feature of the system of the present invention is to add a new function interface module in the original virtual exchange system: a three-layer tunnel interface module, thereby expanding the networking capability of the original virtual exchange system, so that the expanded virtual exchange system can be used in ATM, Ethernet and Provide virtual private LAN segment services under various types of IP communication network environments, which enhances the networking capabilities and application scope of virtual switches.

The method of the present invention is characterized in that layer-3 tunnels are created between the virtual switches, so that the virtual switches on the different network devices can forward Ethernet packets across the wide area network, and a method for establishing a virtual private local area network segment in the wide area network by using the virtual switches is provided. The method has little impact on the original virtual switch system, so that the virtual switch system has strong scalability. The invention can be applied to access server equipment, edge service routers and other equipment in the field of data communication, and has good application prospects.

Description of drawings

FIG. 1 is a schematic structural diagram of a virtual switch system providing virtual local area network segment services according to the present invention.

Fig. 2 is a schematic diagram of the data message format of the transmission of Ethernet packets utilizing the IP protocol in the present invention.

Fig. 3 is a schematic diagram of the form of the GRE tunnel header in the Ethernet packet used by the present invention in Fig. 2 .

Fig. 4 is a schematic diagram of an application networking of an embodiment of the system of the present invention.

Detailed ways

Referring to the expanded virtual switch system structure diagram of the present invention shown in Fig. 1, the present invention is a kind of virtual switch system providing virtual local area network segment (VPLS) service, and it is in the ATM interface module 1, Ethernet of existing virtual switch On the basis of the interface module 2 and the Ethernet switch module 3, a layer-3 tunnel interface module 4 connected to the Ethernet switch module 3 and which completes layer-3 tunnel protocol processing is added.

Among them, the ATM interface module 1 is used to process the 1483B protocol: when data is input, the 1483B encapsulation of the input data is removed to take out the Ethernet packet, and the Ethernet packet is handed over to the Ethernet switching module for exchange; when the Ethernet packet is output, 1483B is added to the Ethernet packet Encapsulated, and then sent out by the ATM interface. The Ethernet interface module 2 is used to process the 802.Q specification: when data is input, the 802.Q encapsulation of the input data is removed to take out the Ethernet packet, and the Ethernet packet is handed over to the Ethernet switching module for switching; when the Ethernet packet is output, the Ethernet The packet adds 802.Q encapsulation and is sent out by the Ethernet interface. The layer-3 tunnel interface module 4 completes the processing of the layer-3 tunnel protocol. The layer-3 tunnel interface module 4 is provided with and maintains a layer-3 tunnel encapsulation table and a key (key)-virtual switch port binding table, and the layer-3 tunnel encapsulation table stores the key (key) value of the tunnel local end, the tunnel The IP address of the peer end and the key (key) value of the tunnel peer end. Key (key)-the virtual switch port binding table stores the key (key) value of the local end of the Layer 3 tunnel, as well as the serial number of the virtual switch and the serial number of the virtual switch port bound to it; There is a one-to-one correspondence between the value of the key (key) and the serial number of the virtual switch bound to it and the serial number of its port. The three-layer tunnel interface module 4 terminates the third-layer tunnel protocol for the input data, takes out the Ethernet packet transmitted by the tunnel, and sends it to the Ethernet switch module for switching; when there is an ether packet to be output from the three-layer tunnel interface , which performs tunnel encapsulation on the Ethernet packet, and then delivers it to the IP forwarding module for forwarding.

The Ethernet switch module 3 is the core of the virtual switch system, and is used to complete virtual switch table item management and Ethernet packet switching functions. Ethernet switching module 3 is provided with a group of independent data table corresponding to virtual switch, when receiving the data that comes from ATM, Ethernet or layer-3 tunnel interface module, searches corresponding virtual switch table according to the port information carried in the data, then according to The virtual switch table records information for looking up port forwarding. If found, it is forwarded to this port, otherwise, it is forwarded to all reachable ports of this virtual switch.

Each thin solid line in Fig. 1 has shown that the data packets from multiple different types of communication networks such as ATM, Ethernet or IP network can realize the interconnection across ATM network, Ethernet and IP network by the virtual switch of the present invention , providing virtual private local area network segment services, which greatly enhances the networking capability and application range of the virtual switch of the present invention.

For constructing a virtual private network (VPN), network tunneling (Tunnelling) technology is a key. Network tunnel technology refers to the use of one network protocol to transmit another network protocol, and a virtual private network (VPN) mainly uses network tunnel protocols to realize its functions. The method of utilizing virtual switch (VS) of the present invention to provide virtual private local area segment (VPLS) service across wide area network is exactly to utilize the third layer tunneling protocol, such as the general purpose proposed by Internet Engineering Task Force (IETF, Internet Engineering Task Force) in RFC1701 Generic Routing Encapsulation (GRE, Generic Routing Encapsulation) tunneling protocol, multi-protocol label switching (MPLS) technology and Internet Protocol Security (IPsec, Internet Protocol Security) technology, etc., realize the transparent transmission of Ethernet packet data as the load of IP data packet , this embodiment takes the GRE tunnel protocol as an example.

Referring to the form of the encapsulated whole message of the present invention shown in Fig. 2, it is to respectively encapsulate the third layer tunnel identification (GRE tunnel head) and IP header at the initial part of this Ethernet packet data. Wherein the IP header contains the IP address of the Layer 3 tunnel interface module at the opposite end of the GRE tunnel, and the form of the GRE tunnel header is shown in Figure 3, where C (bit 0) is the checksum present: if the checksum is used bit is set to 1, then the checksum field is included in the GRE tunnel header, and a valid value is set. R (bit 1) is Routing Present: If the Routing Present bit is set to 1, it indicates that the GRE tunnel header contains offset fields and routing fields, and the effective value. K (bit 2) is the key present: if the key present is set to 1, it indicates that the GRE tunnel header contains the key field, otherwise the GRE tunnel header does not contain the key field. S (bit 3) is the sequence number present: if the sequence number present is set to 1, it indicates that the GRE tunnel header contains the sequence number field, otherwise the GRE tunnel header does not contain the sequence number area. s (bit 4) is strict source route: If all routing information is composed of strict source routes, it is recommended to set this bit to 1. Recur (bits 5-7) is the recursion control: it contains a 3-bit unsigned integer indicating the number of additional encapsulations allowed. This value should default to 0. Flage (bits 8-12) is a field reserved for future applications, and Flage must be set to 0. Ver (bits 13-15) is the version number: the version number field must be set to 0. Protocol Type (2 bytes) is the protocol type: the protocol type field contains the protocol type of the payload packet. The protocol type (Protocol Type) of the present invention is set to: 6558 according to RFC1701 regulation. Checksum (2 bytes) is the checksum: the checksum field contains the IP checksum of the GRE tunnel header and payload packets. Sequence Number (4 bytes) is the sequence number: the sequence number field contains an unsigned 32-bit integer inserted by the packager. Can be used by the receiver to determine the order of packets sent by the encapsulator to the receiver. Offset (2 bytes) is the offset: the offset field describes the offset from the beginning of the routing field (routing field) to the first byte of the active source route entry (activesource route entry) that needs to be checked ( Its unit is byte). Key (4 bytes) is the key: the key field contains a four-byte number inserted by the encapsulator, and the receiver can use it to verify the identity of the sender of the message. Routing: Routing (variable length): The routing field is a list of source route entries.

According to RFC1701, the checksum, offset, key, routing, and sequence number fields are optional. However, when the present invention uses the GRE protocol to encapsulate the message, the GRE tunnel header must contain a checksum field and a key field, and the checksum usage and key usage fields must be set to 1. Offset, routing and serial number fields can be selected according to actual needs.

In order to ensure the correctness of data transmission, the present invention sets a checksum (Checksum) field in the GRE header, and calculates the checksum for the GRE tunnel header and the Ethernet packet data. In order to ensure the security of data transmission in the virtual private local area network, the present invention sets a key (Key) field in the GRE tunnel header. Using this key (Key) field can guarantee the security of the virtual private LAN segment from two aspects:

1. The key (Key) field can carry authentication information. The three-layer tunnel interface module in the virtual switch of the present invention can only process the IP message carrying the correct authentication information in the GRE tunnel head, and all other messages are discarded. This can prevent external attacks on the virtual private LAN segment.

2. The Ethernet switch module in each virtual switch can be configured with multiple virtual switches, and the multiple virtual switches share one layer-3 tunnel interface module. In order to ensure data isolation of each virtual private LAN segment, a mechanism is required to bind each GRE tunnel to its corresponding virtual switch. The method adopted by the present invention is: the management system of the network equipment distributes different key (Key) values for different GRE tunnels, and in the key (Key) field in each GRE tunnel, it can be set to uniquely mark the GRE The key (Key) value of the tunnel, which can be used to uniquely determine the serial number of the virtual switch bound to the tunnel and the port serial number of the virtual switch. In this way, when the Layer 3 tunnel interface module finds the key (Key) value of the GRE tunnel header, it can search the binding relationship table between the key (Key) and the virtual switch port, and send the Ethernet packet to the correct virtual switch for switching , so that different users can be distinguished and the security of data transmitted in the virtual private local area network can be ensured.

The following briefly explains the processing flow of the data packet by the three-layer tunnel interface module: Assume that an enterprise has A branch and B branch in A and B respectively, and uses a virtual switch system to establish a virtual private LAN segment. There is an IP WAN connection between A and B. The Internet service provider configures two virtual switches (denoted as A-VS and B-VS) on the network devices of A and B respectively for the enterprise, and connects the two branches of the enterprise to the corresponding virtual switches. On the switch, ATM access or Ethernet access can be used. Then, the Internet service provider configures a GRE tunnel across the IP WAN between the two virtual switches A-VS and B-VS, and records the binding relationship between the key (Key) value and the corresponding virtual switch port.

The processing flow of branch A sending an Ethernet packet to branch B is: .

(1) The network device at A takes out the Ethernet packet according to the incoming port information of the received data, and sends it to the local virtual switch A-VS.

(2) After receiving the Ethernet packet, the local virtual switch A-VS switches the packet to the output port corresponding to the GRE tunnel according to the destination Ethernet address.

(3) The Layer 3 tunnel interface module searches the "Key (Key)-virtual switch port binding table" according to the output port number to obtain the key (Key) value, and then searches the "GRE tunnel encapsulation table" by the key (Key) value Obtain the GRE protocol encapsulation information, such as the IP address and key (Key) value of the opposite end of the tunnel, and then add a GRE tunnel header and an IP header to the Ethernet packet according to the GRE tunnel protocol.

(4) The layer-3 tunnel interface module forwards the IP packet carrying the Ethernet packet to the IP forwarding module.

(5) The Layer 3 tunnel forwarding module of the network equipment at B receives the IP packet sent by the A-VS through the GRE tunnel, and analyzes the packet according to the protocol number in the IP header to be a packet encapsulated by the GRE tunnel protocol.

(6) The three-layer tunnel interface module continues to analyze the GRE tunnel header content: utilize the checksum field in the GRE tunnel header to check the correctness of the message data, and utilize the key (Key) value in the GRE tunnel header to verify the identity of the sending device; if If there is an error in the packet or the sender fails the verification, the packet will be discarded.

(7) The three-layer tunnel interface module searches for "key (Key)-virtual switch port binding table" according to the key (Key) value in the GRE tunnel header, and determines that the Ethernet packet will be sent to the local virtual switch B-VS, Then the GRE encapsulation of the message is removed, and the Ethernet packet is taken out and delivered to the local virtual switch B-VS.

(8) The local virtual switch B-VS searches the address exchange table of the virtual switch, and sends the Ethernet packet to the port connected to the branch of the enterprise B.

In this way, branch B of the enterprise receives the Ethernet packet sent by branch A. The procedure for branch B to send an Ethernet packet to branch A is the same and will not be repeated here.

Referring to the schematic diagram of the application embodiment of the system of the present invention shown in Fig. 4: each branch point of the enterprise network user accesses the asymmetric digital subscriber line (ADSL, Asymmetric Digital Subscriber Loop) of the server (DSLAM, Digital Subscriber Liner Multiplexer) by the digital subscriber line ) access or LAN gateway (LAN Switch) Ethernet access to the virtual switch of the edge service node of the ISP. The virtual switches of these different edge service nodes can utilize the ATM interface module to cross the ATM backbone network to interconnect; also can utilize the Ethernet interface module to span the Ethernet to interconnect; can also utilize the three-layer tunnel interface module of the present invention to set up the GRE tunnel to cross the IP WAN for interconnection.

Claims (13)

1, a kind ofly provide virtual LAN VPLS the virtual switch of business, this virtual switch includes: atm interface module, ether interface module and ether Switching Module; It is characterized in that: this virtual switch also is provided with the three layer tunnel interface module that is connected with the ether Switching Module, finish the layer 3 Tunnel protocol processing, and this three layer tunnel interface module setting and maintenance have: three layer tunnel encapsulating sheet and key-virtual switch port binding table.

2, the virtual switch that virtual LAN service is provided according to claim 1 is characterized in that: described three layer tunnel encapsulating sheet stores the key value of tunnel local terminal, the IP address of opposite end, tunnel and the key value of opposite end, tunnel.

3, the virtual switch that virtual LAN service is provided according to claim 1, it is characterized in that: described key-virtual switch port binding table stores the key value of this section of three layer tunnel, and the virtual switch sequence number and the virtual switch port sequence number of binding with it; The key value of this section of three layer tunnel and have one-to-one relationship with the virtual switch sequence number and the port sequence number thereof of its binding.

4, the virtual switch that virtual LAN service is provided according to claim 1, it is characterized in that: described three layer tunnel interface module is for the data of input, by its termination layer 3 Tunnel protocol, take out the ether bag of tunnel transmission, and deliver the ether Switching Module and exchange; Touch piece when output as the ether bag from the three layer tunnel interface, the ether bag is carried out tunnel encapsulation, give IP forward module then and transmitted by it.

5, the virtual switch that virtual LAN service is provided according to claim 1, it is characterized in that: described ether Switching Module is the core of this virtual switch system, is used to finish the function of exchange of management of virtual switch list item and ether bag.

6, the virtual switch of virtual LAN service is provided according to claim 1 or 5, it is characterized in that: this ether Switching Module is provided with one group of independently corresponding with virtual switch tables of data, when receiving from data that ATM, ether or three layer tunnel interface module are come, search corresponding virtual switch table according to the port information that carries in the data, transmit according to the information searching port of this virtual switch table record then.

7, a kind of virtual switch VS that utilizes provides virtual private LAN section VPLS the method for business, it is characterized in that:

(1) between different virtual switches, uses layer 3 Tunnel protocol to set up three layer tunnel, the passage that ether bag data is carried out transparent transmission as the load of IP packet is provided;

(2) the ether bag data that needs are transmitted are carried out the layer 3 Tunnel protocol encapsulation, and transmit by three layer tunnel.

8, leap IP wide area network according to claim 7 provides the method for virtual private LAN section business, and it is characterized in that: described step (2) further comprises:

(21) local network device takes out the ether bag according to the ingress port information that receives data, and gives the local virtual switch it;

(22) after the local virtual switch is received the ether bag, this packet switch is gone to the output port corresponding with three layer tunnel according to purpose ether address;

(23) the three layer tunnel interface module obtains the layer 3 Tunnel protocol packaging information according to the output slogan, stipulate to add three layer tunnel sign-generic route encapsulation gre tunneling head and IP head by layer 3 Tunnel protocol then, and send by three layer tunnel to this ether bag;

(24) the three layer tunnel forwarding module of destination network equipment is received the IP message that sends by three layer tunnel, determines the destination virtual switch according to three layer tunnel sign and IP head, takes out the ether bag and gives the destination virtual switch;

(25) the destination virtual switch is delivered to destination network equipment to the ether bag.

9, describedly provide virtual private LAN section VPLS the method for business according to claim 7 or 8, it is characterized in that: the described employed layer 3 Tunnel protocol of IP tunnel of setting up includes: generic route encapsulation gre tunneling agreement, multi protocol label exchange MPLS technology and internet protocol secure IPsec technology.

10, according to claim 9ly provide virtual private LAN section VPLS the method for business, it is characterized in that: described three layer tunnel is designated generic route encapsulation gre tunneling head.

11, according to claim 8ly provide virtual private LAN section VPLS the method for business, it is characterized in that: described IP head contains the IP address of the three layer tunnel interface module of three layer tunnel opposite end, be provided with verification and territory and key territory in the three layer tunnel sign, and verification uses the territory must be set to 1 with use territory and key.

12, according to claim 11ly provide virtual private LAN section VPLS the method for business, it is characterized in that: described verification and territory be used for to three layer tunnel sign and the check of ether bag data computation with, described key is provided with the key value that indicates three layer tunnel uniquely in the territory, and this key value is used for determining uniquely and the virtual switch sequence number of tunnel binding and the port sequence number of this virtual switch.

13, according to claim 12ly provide virtual private LAN section VPLS the method for business, it is characterized in that: can carry the authorization information that verification is used when being used for the three layer tunnel interface modules handle in the described key territory, prevent the attack of outer bound pair virtual private LAN section.

Images