CN1404263A - Realizing method and system of special network in wideband virtual network - Google Patents

Abstract

The present invention relates to a method for realizing a broadband network virtual private network system and the system thereof. The method mainly includes the following steps: firstly, the entry data link of the system can be configured to belong to a certain VPLS or a certain virtual router as required; secondly, Multiple data links connected to a VPLS realize complete Ethernet switching and perform special processing; finally, VPLS can choose whether to connect to a virtual router inside the system according to needs. The present invention realizes a plurality of virtual switching routers by combining the routing method according to the Ethernet address and the routing method according to the IP address, so that each virtual private network system is a complete virtual private local area network segment and can be independent of each other. , used alone, and can realize intercommunication through routing to form multiple dedicated systems, and the system is more advanced, simple and reliable than the existing VPN in terms of manageability, networking capabilities, and robustness.

Description

Realization method and system of broadband network virtual private network

technical field

The invention belongs to the virtual switch router technology of data communication broadband network, and in particular relates to a method for realizing a broadband network virtual private network (VPN—Virtual Private Network) system and a system thereof.

Background technique

With the rapid development of broadband networks, modern enterprises and government agencies need to interconnect computer networks in multiple office locations. The distance between these office locations may range from one or two kilometers to several thousand kilometers, and the number of information points (the number of computers connected to the network) at each location ranges from a few to thousands. A typical large company needs to form a computer network all over the country , the number of connected computers reaches tens of thousands.

It is obviously uneconomical and unreasonable for companies to lay lines and build their own dedicated networks. Usually, enterprises purchase virtual private network (VPN—Virtual Private Network) services provided by Internet Service Providers (ISPInternetProvider) to set up their own private networks. Therefore, how to implement VPN in a reasonable way is a problem that ISPs and network equipment providers need to solve.

The virtual private network VPN recommended by the Internet Engineering Task Force (IETF) includes four types (please refer to "RFC2764 A Eramework for IP Based Virtual Private Networks", B.Gleeson, A.Lin, J.Heinanen, G.Armifage, A. Malis, February 2000):

(1) Virtual Private Dial Networks (VPDN—Virtual Private Dial Networks)——meaning that users use dial-up networks to access corporate data centers. Users obtain a private address from corporate data centers, but user data can be transmitted across public data networks. Can use PPTP, L2F, L2TP to realize.

(2) Virtual Lease Line (VLL—Virtual Lease Line)—the simplest VPN type, a leased line is simulated through an IP tunnel between the two ends, which can be realized by using IPIP, GRE, L2TP, VTP, MPLS, etc.

(3) Virtual Private Routed Networks (VPRN—Virtual Private Routed Networks)—Enterprises can use public data networks to build their own private enterprise networks. Users can freely plan addresses, routing strategies, security mechanisms, etc. between branches of the enterprise. Implementation protocols include IPIP, GRE, L2TP, VTP, MPLS, etc.

(4) Virtual Private LAN Segment (VPLS - Virtual Private LAN Segment) - is to use the Internet to simulate a local network.

VLL and VPDN are the simplest VPN methods, and VPLS and VPRN are more advanced VPN methods.

Under the existing technical conditions, ISP can provide the simplest VLL service by renting out DDN, X.25, ATMPVC according to user needs, or provide VPDN service through the access server, and VPLS service is rarely provided.

Contents of the invention

The purpose of the present invention is to provide a multi-virtual switching router system that can virtualize multiple dedicated broadband switch/router virtual systems in a single broadband switch/router system, and each virtual system is independent of each other, forming multiple It is a dedicated system that can be used separately and can communicate with each other through routers. At the same time, each virtual private system is a complete virtual private local area network segment (VPLS—Virtual Private LAN Segment) broadband network virtual private network (VPN—Virtual Private Network ) system and system thereof, wherein the realization method of this broadband network virtual private network (VPN——Virtual Private Network) system comprises the following steps:

a. Determine whether there is a data packet arriving, if no data packet arrives, restart waiting for the data packet to arrive; otherwise

B, according to the data link configuration, identify the input port type of the data packet, judge whether the data packet is sent to the virtual private local area network segment VPLS or send to the router; if the data packet is sent to the router, then go to step e; if the data packet is Send to the virtual private LAN segment VPLS

c, further identifying the virtual private local area network segment VPLS serial number and the virtual private local area network segment VPLS virtual port serial number to which the input port of the data packet belongs;

D, forward in this virtual private local area network segment VPLS according to data packet ethernet address, then go to step g after forwarding;

e, further identifying the serial number of the router to which the input port of the data packet belongs and the virtual port serial number of the router;

f. According to the IP address of the data packet, it is forwarded in this router;

g, judge whether the forwarding exit is the port of VPLS of other virtual private local area network segments, if it is, turn back to step c; otherwise

h. Determine whether the forwarded export is sent to other routers of the machine, if yes, go back to step e; otherwise

i. Forward to the system output port;

j. End the task and restart to wait for the arrival of the data packet.

Wherein the process of forwarding in this virtual private local area network segment VPLS among the above-mentioned steps d comprises the following steps:

d1, judge whether there is a data packet to be processed, if there is no data packet to be processed, then restart to wait for the data packet to arrive; otherwise

d2, analyze the packet header, check whether the data packet is legal, if not legal, go to step d12; otherwise

d3, analyze whether the IP packet is carried inside the Ethernet packet, if it is an IP packet, record the corresponding virtual private local area network segment VPLS serial number and virtual private local area network segment VPLS of the IP address in the address resolution protocol ARP lookup table of the router with the IP packet Virtual port number, Ethernet source address and other related information for the address resolution protocol ARP process; otherwise

d4. Analyze and judge whether the destination address of the Ethernet packet is a unicast address or a multicast or broadcast address, if it is a multicast or broadcast address, transfer to d11; otherwise

d5, unicast Ethernet destination address search, learn Ethernet source address and source IP address;

d6. Determine whether the Ethernet destination address matches, if not, go to d11, otherwise

d7. Update the address aging timer;

d8. Check the VPLS topology of the virtual private LAN segment to judge whether it conforms to the topology rules and allow forwarding. If forwarding is not allowed, go to d12, otherwise

d9, forwarding to the system output port;

d10, end the task and start to wait for the data packet to arrive again;

d11. Broadcast the data packet to all ports in the VPLS of this virtual private LAN segment, and transfer it back to the upper

Describe step d8;

d12. Discard the data packet, and go to the above step d10.

Simultaneously, the process of forwarding in this router according to the IP address of the packet in the above-mentioned steps f comprises the following steps:

f1, judge whether there is a data packet to be processed, if there is no data packet to be processed, then restart to wait for the data packet to arrive; otherwise

f2, verify whether the ingress data packet meets the routing forwarding requirements, if not, then go to step f9; otherwise

f3, check whether the IP header is legal, if the IP header is illegal, then go to step f12, otherwise

f4, carry out route search, judge whether to match according to search result, if route search result does not match, then go to step f10, otherwise

f5, reduce the TTL of the IP packet header by 1 and generate a new IP packet header with the matched data packet of the search result together with the table lookup result, and recalculate the checksum of the Chinese checksum of the IP packet header;

f5. Perform address resolution protocol ARP processing according to the next-hop IP address to obtain the destination Ethernet address;

f7, the IP packet is encapsulated into the Ethernet packet and forwarded to the virtual private local area network segment VPLS where the destination port is located;

f8, end this task, and start again, waiting for new data packets to arrive;

f9, according to the requirements of the routing protocol, judge whether the data packet is another data packet that needs to be handed over to the protocol software for processing, if not then go to step f12; otherwise

f10, hand over to the protocol software for routing protocol processing, and analyze the destination route;

f11, judging whether the destination route analysis is successful, if successful, turn back to step f5; otherwise

f12. Lose the data packet, and return to step f8.

The broadband network virtual private network VPN system of the present invention comprises: main control board MPU, is used for completing functions such as platform management, signaling control, routing management, wherein platform management includes equipment management, configuration management, link setting, routing management Including collecting routing information, forming a forwarding table, and maintaining synchronization with each interface board through a synchronization mechanism, forwarding data packets that cannot be forwarded by each interface board (including IP packets with OPTION, multicast packets) and an interface management mechanism;

The switching network board NET is used to provide high-speed switching channels for other boards, so that other boards can exchange data packets and other control information without blocking;

The line processing unit LPU is used to provide various physical link interfaces, such as 100M Ethernet electrical interface, Gigabit Ethernet optical interface, 155M/622M/2.5GATM optical interface, 155M/622M/2.5GPOS optical interface, etc. The function of connecting other network devices;

The routing function module RFM is an execution component of the virtual private local area network segment VPLS, and is used to provide the layer-2 switching function and routing forwarding processing function of the virtual private area network segment VPLS;

The main control board MPU, the switching network board NET, the line processing board LPU, and the routing function module RFM are connected to each other through corresponding data buses (such as 1483B and other data lines) to form a whole.

The present invention realizes a plurality of virtual switching routers by combining the routing method according to the Ethernet address and the routing method according to the IP address, so that each virtual private network system is a complete virtual private local area network segment (VPLS—— Virtual Private LAN Segment) can be independent of each other and used alone, and can also communicate with each other through routing to form multiple dedicated systems, and the system is thinner than existing broadband networks in terms of manageability, networking capabilities, and robustness. The network VPN method is more advanced, simple and reliable.

Simultaneously the present invention is owing to distinguish a plurality of dedicated systems with data link layer information, virtual private local area network section VPLS system inside according to the destination address look-up table that Ethernet packet head carries obtains the outlet port information, and data packet is forwarded to outlet port; If look-up table If there is no match, it will be forwarded to all other ports in the VPLS system of this virtual private LAN segment. Therefore, each dedicated system has independent Ethernet address learning and address elimination functions.

Simultaneously according to the present invention, also can designate the maximum Ethernet address quantity that each virtual private system supports simultaneously, and can isolate the Ethernet address that each virtual private local area network section VPLS uses, isolates the shared resource, makes each A virtual private system is not affected by other virtual private LAN segment VPLS systems.

Moreover, according to the present invention, it is also possible to flexibly set the virtual network topology relationship between ports inside each virtual private local area network segment VPLS.

In summary, the present invention has the following advantages:

1. Enable a single switch router to virtualize multiple dedicated systems

General switching routers cannot virtualize multiple private systems, and cannot handle the broadband network virtual private network VPN mode of the virtual private office network segment VPLS. The invention can realize virtual multiple virtual private office network segment VPLS of a single switching router.

2. Provide advanced broadband network virtual private network VPN mode - virtual private office network segment VPLS, with a small number of connections and at the same time achieve the effect of a fully interconnected network

Due to the virtual switching/virtual routing services provided, the communication lines used by the enterprise network interconnection can be greatly reduced.

An example is as follows, assuming that an enterprise in a MAN has 5 office locations, if multiple office locations need to be fully interconnected, up to 4+3+2+1=10 communication lines need to be used to connect any two Office location; if the virtual switch among the present invention is used, only 5 communication lines connected to the virtual switch router are needed to realize full interconnection. Reduces the cost and complexity of enterprise broadband interconnection.

3. Provide a broadband enterprise virtual private network system with simple processing and rich bandwidth.

Because the virtual private network system that the present invention proposes has utilized the technology of Ethernet exchange, avoids relying on complicated routing technology completely, has the advantage that handles relatively simple, thus can provide up to thousands of virtual private local area network segments VPLS and VPLS in a single system A small number of virtual routers can provide more virtual systems than systems that rely solely on routing technology.

4. Provide virtual private exchange routing services with the least management difficulty.

In the virtual private local area network segment VPLS system of the present invention, the complicated technical problems caused by IP address overlapping and routing configuration among multiple enterprises are avoided. The invention effectively reduces the workload and difficulty of network management.

5. Provide the function of network topology tailoring, which can change the topology of the network according to the needs.

The step d8 of the VPLS process of the virtual private area network segment of the present invention can cooperate with the access list to realize multiple topological structure restrictions in a very simple manner, and form each port of the virtual private area network segment VPLS into a star type, a full interconnection type, or any required Network topology.

6. Save the equipment investment cost of ISP

According to the present invention, a single virtual switching system can provide up to hundreds of virtual switching systems and several virtual routing systems. In other words, a single device can solve the internal interconnection problems of many enterprises.

ISP buys the virtual switch router designed according to the invention with the cost of purchasing a single switch router, and the number of enterprise interconnections that can be supported is increased hundreds of times. The same equipment investment can get up to hundreds of times the return.

The composition of the present invention and its implementation method and working principle are described in detail below in conjunction with the accompanying drawings:

Description of drawings

Fig. 1 is a system block diagram of the present invention;

Fig. 2 is a system processing flowchart of the present invention;

Fig. 3 is the internal forwarding flowchart of virtual private local area network segment VPLS of the present invention;

Fig. 4 is the internal forwarding flowchart of the virtual router of the present invention;

Detailed ways

As shown in Fig. 1～Fig. 4, the implementation method of broadband network virtual private network (VPN——VirtualPrivate Network) system of the present invention comprises the following steps:

a, judge whether there is data packet to arrive, wherein the entrance of data packet can be ATM virtual channel ATMVC, Ethernet port, position (POS-position) interface etc., but no matter what port of physical layer and what encapsulation of link layer, enter The packet content of the virtual private LAN segment VPLS must be an Ethernet packet. At the same time, it is determined whether the data link belongs to the entrance of the virtual private area network segment VPLS or the entrance of the router during system configuration. If no packet arrives, restart waiting for the packet to arrive; otherwise

B, according to the data link configuration, identify the input port type of the data packet, judge whether the data packet is sent to the virtual private local area network segment VPLS or send to the router, if the data packet is sent to the router, then go to step e; if the data packet is Send to the virtual private LAN segment VPLS

c. Since there can be as many as thousands of virtual private local area network segments VPLS in the system, when the data link is configured to be sent to the virtual private area network segment VPLS, further identify the virtual private local area network segment VPLS sequence number and virtual private area network segment to which the input port of the data packet belongs. Private LAN segment VPLS virtual port serial number, which information is used for forwarding in the specific virtual private LAN segment VPLS;

D, forward in this virtual private local area network segment VPLS according to data packet ethernet address, forward to step g after forwarding;

Wherein the process described in this step forwards in this virtual private local area network segment VPLS according to the packet Ethernet address comprises the following steps:

d1, judge whether there is a data packet to be processed, if there is no data packet to be processed, then restart to wait for the data packet to arrive; otherwise

d2, analyze the packet header, check whether the data packet is legal, wherein analysis in this step, check whether the packet is legal if the packet header has link layer encapsulation, then analyze and check whether the packet header link layer encapsulation is legal, if not legal Go to step d12; otherwise

d3, analyze whether the IP packet is carried inside the Ethernet packet, if it is an IP packet, record the corresponding virtual private local area network segment VPLS serial number and virtual private local area network segment VPLS of the IP address in the address resolution protocol ARP lookup table of the router with the IP packet Virtual port number, Ethernet source address and other related information for the address resolution protocol ARP process; otherwise

d4. Analyze and judge whether the destination address of the Ethernet packet is a unicast address or a multicast or broadcast address, if it is a multicast or broadcast address, then go to d11; otherwise

D5, unicast Ethernet destination address search, learning Ethernet source address and source IP address; Wherein learning Ethernet source address and source IP address in this step is the Ethernet source address of the packet and the corresponding virtual private local area network segment VPLS serial number, VPLS virtual port serial number of the entrance virtual private LAN segment, port type and other relevant information are recorded in the Ethernet address lookup table. If the lookup table already has entries with the same Ethernet source address and virtual private LAN segment VPLS serial number, Replace the original information with new information. This process realizes Ethernet address learning. The address learning process is based on the VPLS sequence number of the virtual private LAN segment and the Ethernet source address. This learning method can ensure that each virtual private LAN segment VPLS has its own separate Ethernet address space. It plays the role of isolating multiple virtual private LAN segments VPLS, and at the same time, limits the maximum number of Ethernet addresses allowed by each virtual private LAN segment VPLS. Wherein, before learning a new Ethernet address, first compare whether the number of Ethernet addresses of the virtual private local area network segment VPLS exceeds a preset value, if not, learn, otherwise do not learn. After the learning operation is completed, add one to the existing Ethernet address count of the virtual private local area network segment VPLS, and this count is used for comparison before the next address learning operation. This address learning method realizes the limitation of the maximum number of Ethernet addresses for each virtual private LAN segment VPLS, and makes the storage space of each virtual private LAN segment VPLS Ethernet lookup table controlled, avoiding the virtual private LAN segment VPLS due to Resource conflicts due to sharing limited lookup table space. Isolating the shared resources between the VPLSs of virtual private LAN segments is an important means for ensuring the robustness of the system in the present invention. This step also uses the virtual private local area network segment VPLS sequence number and the Ethernet destination address to find out the data forwarding port information in the Ethernet address lookup table, including related content such as the outgoing port type, the outgoing port number, and the link layer encapsulation method.

d6. Determine whether the Ethernet destination address matches, if not, go to d11, otherwise

d7. Updating the address aging timer; updating the address aging timer in this step is to time out each Ethernet source address in the virtual private local area network segment VPLS. If there is no source address within a period of time for the arrival of a data packet with a certain Ethernet address, and the corresponding address elimination timer expires, the VPLS sequence number of the virtual private local area network segment and the lookup table item corresponding to the Ethernet source address are eliminated, and the The timer is reset. Whenever a data packet arrives, the virtual private local area network segment VPLS sequence number of the data packet and the Ethernet source address corresponding to the infinite address elimination timer are cleared.

d8. Check the VPLS topology of the virtual private LAN segment to determine whether it complies with the topology rules and allow forwarding. If forwarding is not allowed, go to d12, otherwise

d9, forwarding to the system output port;

d10, end the task and start to wait for the data packet to arrive again;

d11. Duplicate the Ethernet broadcast data packet in multiple copies, and broadcast it to all ports in the VPLS of this virtual private local area network segment, and turn back to the above-mentioned step d8;

d12. Discard the data packet, and go to the above step d10.

e. When the data link mark should be sent to the router, since the system may have more than one virtual router, the input port of the data packet is further identified, that is, the sequence number of the router to which the data packet entry data link belongs and the virtual port sequence number of the router to which it belongs. This information is used for forwarding in the router;

f. According to the IP address of the data packet, it is forwarded in this router;

Wherein in this step, the process of forwarding in this router according to the IP address of the packet comprises the following steps:

f1, judge whether there is a data packet to be processed, if there is no data packet to be processed, then restart to wait for the data packet to arrive; otherwise

f2, verify whether the ingress packet is an IP packet meeting the routing forwarding requirements, wherein the specific forwarding conditions must include:

1. The Ethernet destination address matches the Ethernet address of the router interface;

2. The protocol type is an IP packet, but the conditions are not limited to these, and other conditions or requirements may also be arranged according to the specific circumstances. If the forwarding requirements are not met, then go to step f9; otherwise

f3, check whether the IP header is legal, if the IP header is illegal, then go to step f12, otherwise

f4, perform route search, and judge whether it matches according to the search result, wherein the route search in this step is to perform route search according to RFC 1519 with the longest matching method, and the specific search method can refer to "RFC1519 Classless Inter-Damain Routing (CIDR) an Address Assignment and Aggregation Strategy", relevant part of V.Fuller, T.Li, J.Yu, K.Varadhan, September1993. (Status: Proposed Standard). If the route lookup result does not match, then go to step f10, otherwise

f5, the TTL of IP packet header is subtracted 1 and the data packet that search result matches generates new IP packet header together with table lookup result, and described table lookup result includes information such as output port number, direct routing, next IP, and according to The result of the lookup table recalculates the checksum of the Chinese checksum of the IP header, and completes the modification of the IP header at the same time;

f6, perform address resolution protocol ARP processing according to the next-hop IP address obtained by routing search, and obtain the destination Ethernet address;

f7, modify the Ethernet encapsulation of the data packet according to the processing result of the address resolution protocol ARP by this IP packet, and encapsulate the IP packet in the Ethernet packet and forward it to the virtual private local area network segment VPLS where the destination port is located;

f8, end this task, and start again, waiting for new data packets to arrive;

f9, according to the requirements of the routing protocol, judge whether the data packet is another data packet that needs to be handed over to the protocol software for processing, if not then go to step f12; otherwise

f10, hand over to the protocol software for routing protocol processing, and analyze the destination route;

f11, judging whether the destination route analysis is successful, if successful, turn back to step f5; otherwise

f12. Lose the data packet, and return to step f8.

g, judge whether the forwarding exit is the port of other virtual private local area network segment VPLS, if yes, then turn back to step c; otherwise

h. Determine whether the forwarded export is sent to other routers of the machine, if yes, go back to step e; otherwise

i. Forwarding to the system output port; Forwarding to the system output port in this step is to add link layer encapsulation to the data packet according to the requirements of the output port, and send it to the physical output port by switching.

Wherein the processing of three steps such as step g, h, i described in the present invention can guarantee that the virtual private local area network section VPLS of the system can be cascaded with the virtual private local area network section VPLS of the system or other routers, so that the system has a larger The flexibility enables the logical structure of the system to be adjusted flexibly.

j. End the task and wait for new data packets to arrive again.

In summary, according to the implementation method of the present invention, the switched router system can be virtualized into up to hundreds of virtual private systems, and each virtual private local area network segment VPLS uses Ethernet switching technology to realize switching, and multiple virtual private Routers can be used to implement IP layer routing between VPLS in LAN segments.

As shown in Figure 1, the broadband network virtual private system realized according to the above-mentioned implementation method includes: a main control board MPU, which is used to complete functions such as platform management, signaling control, and routing management, wherein platform management includes equipment management, configuration management, link management, etc. Route setting, routing management includes collecting routing information, forming a forwarding table, and maintaining synchronization with each interface board through a synchronization mechanism, forwarding data packets that cannot be forwarded by each interface board (including IP packets with OPTION, multicast packets) and interface management mechanism ;

The switching network board NET is used to provide high-speed switching channels for other boards, so that other boards can exchange data packets and other control information without blocking;

The line processing unit LPU is used to provide various physical link interfaces, such as 100M Ethernet electrical interface, Gigabit Ethernet optical interface, 155M/622M/2.5GATM optical interface, 155M/622M/2.5GPOS optical interface, etc. The function of connecting other network devices;

The routing function module RFM is an execution unit of the virtual private local area network segment VPLS, and is used to provide the layer 2 switching function and routing and forwarding processing function of the virtual private area network segment VPLS. As a single board of a multi-virtual switch router, RFM is inserted into the frame through the configuration management platform on the MPU to configure the virtual private LAN segment VPLS on the RFM, as shown in Figure 1, each LPU receives data packets from the line, It is switched to the RFM board through the SFU, and the VPLS and routing processing of the virtual private LAN segment are completed in the RFM.

Among them, the main control board MPU, the switching network board NET, the line processing board LPU, and the routing function module RFM are connected to each other through a data bus (such as a data line such as 1483B) to form a whole.

Claims (12)

1, a kind of implementation method of special network in wideband virtual network is characterized in that may further comprise the steps:

A, judged whether that packet arrives,, restarted then to wait for that packet arrives if the free of data bag arrives; Otherwise

B, according to data link configuration, the input port type of recognition data bag judges that this packet mails to the virtual special local area network section or mails to router; If packet is to mail to router then forward step e to; If packet is to mail to virtual special local area network Duan Ze

The empty port sequence number of virtual special local area network section sequence number under the input port of c, further recognition data bag and virtual special local area network section;

D, in this virtual special local area network section, transmit, transmit and then forward step g to after finishing according to the packet ethernet address;

The empty port sequence number of router sequence number and router under the input port of e, further recognition data bag;

F, in this router, transmit according to the IP address of packet; Forwarding finishes then

The outlet that g, judgement are transmitted is the port of other virtual special local area network sections, if rotate back into step c; Otherwise

Whether the outlet that h, judgement are transmitted mails to other routers of this machine, if then rotate back into step e; Otherwise

I, be forwarded to system's outbound port;

J, end task, and restart to wait for that packet arrives.

2,, it is characterized in that the process of transmitting among the above-mentioned steps d may further comprise the steps in this virtual special local area network section according to the implementation method of the described special network in wideband virtual network of claim 1:

D1, judged whether that packet is pending,, restarted then to wait for that packet arrives if the free of data bag is pending; Otherwise

D2, analysis packet header, whether the check data bag is legal, if the illegal steps d 12 that forwards to; Otherwise

D3, analyze the whether IP bag of the inner carrying of Ethernet bag, if IP wraps relevant informations such as this IP address corresponding virtual dedicated local-area network segment sequence number of record in the address resolution protocol look-up table that then this IP is wrapped in router, the empty port numbers of virtual special local area network section, ethernet source address, use for the address resolution protocol process; Otherwise

D4, analysis and judgement Ethernet bag destination address are unicast address or multicast or broadcasting, if multicast or broadcast address forward d11 to; Otherwise

D5, clean culture Ethernet destination address are searched, study ethernet source address and source IP address;

D6, judge whether the Ethernet destination address mates, and does not forward d11 to if match, otherwise

D7, scheduler age timer;

D8, carry out the inspection of virtual special local area network section topology, judge whether to meet topology rule and allow and transmit, if do not allow to transmit then forward d12 to, otherwise

D9, be forwarded to system's outbound port;

D10, end task, and restart to wait for that packet arrives;

D11, with packet all of the port broadcasting in this virtual special local area network section, and rotate back into above-mentioned steps

d8；

D12, abandon this packet, and forward above-mentioned steps d10 to.

3, whether according to the implementation method of the described special network in wideband virtual network of claim 2, it is characterized in that analyzing among the above-mentioned steps d2 packet header, check packet header legal is whether analyze the packet header link encapsulated layer of packet legal.

4, according to the implementation method of the described special network in wideband virtual network of claim 2, it is characterized in that among the above-mentioned steps d5 study ethernet source address and source IP address be with relevant information records such as the ethernet source address of this packet and corresponding virtual dedicated local-area network segment sequence number, the empty port sequence number of inlet virtual special local area network section, port types in the ethernet address look-up table, if look-up table has had ethernet source address and all identical list item of virtual special local area network section sequence number, then replace original information with new information.

5, according to the implementation method of claim 2 or 3 or 4 described special network in wideband virtual network, when it is characterized in that above-mentioned steps d5 carries out, its front also has a steps d 51, this steps d 51 is before new ethernet address of study, relatively whether the ethernet address number of this virtual special local area network section counting surpasses predefined value earlier, if do not exceed then learn, otherwise do not learn.

6, according to the implementation method of claim 2 or 3 or 4 described special network in wideband virtual network, when it is characterized in that above-mentioned steps d5 carries out, its back also has a steps d 52, this steps d 52 is after learning manipulation is finished, existing ethernet address counting to this virtual special local area network section adds 1, and this counting supplies relatively to use before the address learning operation next time.

7, according to the implementation method of the described special network in wideband virtual network of claim 2, it is characterized in that scheduler age timer among the above-mentioned steps d7 is is that the packet of certain ethernet address arrives if there is not source address in a period of time, it is full that the timer timing is eliminated in corresponding address, then eliminate the list item of searching of this virtual special local area network section sequence number and ethernet source address correspondence, and this timer resetted, and, then the virtual special local area network section sequence number and the ethernet source address corresponding address of this packet are eliminated the timer zero clearing whenever there being packet to arrive.

8, according to the implementation method of the described special network in wideband virtual network of claim 2, it is characterized in that among the above-mentioned steps d11 packet being broadcasted to all of the port of this virtual special local area network section is earlier this Ethernet broadcast data packet to be duplicated many parts, again with its all of the port broadcasting in this virtual special local area network section.

9,, it is characterized in that the process of transmitting in this router according to the IP address of packet among the above-mentioned steps f may further comprise the steps according to the described special network in wideband virtual network of claim 1:

F1, judged whether that packet is pending,, restarted then to wait for that packet arrives if the free of data bag is pending; Otherwise

Whether f2, checking entry data bag are to meet the IP bag that routing forwarding requires, if do not meet the forwarding requirement, then forward step f9 to; Otherwise

F3, whether legal, if IP packet header is illegal, then forward step f12 to if veritifying IP packet header, otherwise

F4, carry out route querying, judge whether coupling,, then forward step f10 to if route searching result does not match according to lookup result, otherwise

F5, with the TTL in IP packet header subtract 1 and with the packet of lookup result coupling together with checking result, generates new IP packet header, and recomputates the Chinese check value in IP packet header;

F6, carry out address resolution protocol according to next-hop ip address and handle, obtain the purpose ethernet address;

F7, IP sealed the virtual special local area network section that installs in the Ethernet bag and be forwarded to the destination interface place;

F8, finish this subtask, and restart, wait for that new packet arrives;

F9, according to the requirement of Routing Protocol, whether the judgment data bag is other packet that need hand over the protocol software to handle, if not then forwarding step f12 to; Otherwise

F10, give the protocol software and carry out Routing Protocol and handle, resolve the purpose route;

F11, judge the whether success of purpose routing resolution, if success then rotate back into step f5; Otherwise

F12, with data-bag lost, and rotate back into step f8.

10, according to the implementation method of the described special network in wideband virtual network of claim 1, it is characterized in that packet described in the above-mentioned steps a is the Ethernet bag, its inlet can be ATM Virtual Channel, ethernet port, positional interface or other forms of interface.

11, according to the implementation method of the described special network in wideband virtual network of claim 1, it is characterized in that being forwarded among the above-mentioned steps i system's outbound port is that requirement adds link layer packaging according to outbound port with packet, mails to the physics outbound port with the mode that exchanges.

12, a kind of special network in wideband virtual network system that is used for the described implementation method of claim 1 is characterized in that this system comprises:

Master control borad, be used to finish functions such as platform management, signaling control, routing management, wherein platform management comprises equipment control, configuration management, link setting, routing management comprises the collection routing iinformation, formation is transmitted, and by synchronization mechanism synchronously, transmit bag and interface management mechanism that each interface board can not be transmitted with each interface board maintenance;

Network board is used to other each veneer that at a high speed switching path is provided, and makes other each veneer can choke free mutual exchange data packets and other control information;

Line Processing Unit is used to provide multiple physical link interface, as 100M Ethernet electrical interface, gigabit Ethernet optical interface, 155M/622M/2.5GATM optical interface, 155M/622M/2.5GPOS optical interface etc., realizes the function of docking with other network equipment;

The routing function module is the execution unit of virtual special local area network section, is used to provide the two layers of function of exchange and the routing forwarding processing capacity of virtual special local area network section;

Be interconnected to form an integral body by corresponding data/address bus between wherein said master control borad, network board, Line Processing Unit, each parts of routing function module.

Images