JP2003169070A - Repeated network address conversion system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To actualize an SNMP agent function for a plurality of independent IP address spaces in which private addresses are possibly repetitive by single equipment. <P>SOLUTION: The independent IP address spaces 1-1, 1-2,..., 1-n are connected to a management network 2 through a management network address converting means 10. The management network address converting means 10 performs conversion into an address of the management network 2 including the address of SNMP by combinations of identification information and addresses of the independent IP address spaces 1-1, 1-2,..., 1-n for communication data having the identification information for identifying the independent IP address spaces 1-1, 1-2,..., 1-n. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network management function (SNM) by a single device for a plurality of independent network spaces constructed by IP addresses.
The present invention relates to a duplicate network address translation system that provides a P proxy function).

[0002]

2. Description of the Related Art Generally, SNMP (Simple Network Man
network management by the agement protocol) is realized by the SNMP manager and the SNMP agent exchanging data using a database of a recommended format. If any failure occurs in the device of the SNMP agent, the SNMP agent sends a trap notifying the failure to the SNMP manager. When the SNMP manager receives the trap, it processes the trap.

On the other hand, VPN (Virtua) is a technique for constructing a large-scale private network at low cost.
l Private Network). For example, MPLS (Multi
In VPN based on Protocol Label Switching technology, the carrier side provides an MPLS network, and the subscriber side simply connects the private network owned by each unit to the MPLS network in units that are geographically independent, such as the head office and branch offices. It is possible to build a large-scale private network that is independent for each subscriber while maintaining security.

[0004]

However, in the case where the above-mentioned SNMP manager function is provided to the IP address space with such a plurality of private addresses, for example, a carrier providing the VPN service as described above is used. Tried to provide a network monitoring function, there were the following problems.

That is, since a plurality of address spaces are independent of each other, an IP address of a certain address space may be used in a different address space. Therefore, even if a plurality of independent address spaces are simply connected to provide the SNMP agent function, the expected processing cannot be performed because the IP address conflict occurs.

[0006] Therefore, as a means for solving such a problem, the SNMP for the number of a plurality of independent address spaces is used.
It is possible to install an agent device. However, if the above VPN carrier has 1000 subscribers, for example, 1000 SNMP agent devices are required. Therefore, such a solution may not be a realistic solution at large scale.

[0007]

The present invention adopts the following constitution in order to solve the above-mentioned problems. <Configuration 1> A duplicate network address conversion system that connects a plurality of networks that allow overlapping of addresses between independent networks and a management network for providing a network management service. Management network address conversion means for converting addresses of a plurality of networks into addresses of a management network by a combination of the identification information and the network address, with respect to communication data having identification information for identification. Duplicate network address translation system.

<Structure 2> In the duplicate network address conversion system according to Structure 1, there is provided a management network address conversion means for converting the network address in the communication data and the network address portion of the SNMP into the management network address. A duplicate network address translation system.

<Structure 3> A plurality of networks that allow overlapping of addresses between independent networks,
A duplicate network address conversion system for connecting a management network for providing a network management service, wherein the identification information and the network address are provided for communication data having identification information for identifying a plurality of independent networks. The address conversion means for converting the addresses of a plurality of networks into addresses that do not overlap in the management network and the conversion of the SNMP address part in the communication data so as to match the network address converted by the address conversion means. A duplicate network address conversion system, comprising: a management network address converter for performing.

[0010]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to specific examples. << Specific Example 1 >><Configuration> FIG. 1 is a configuration diagram showing a specific example 1 of the duplicate network address translation system of the present invention. In the figure, 1-1, 1-2, ..., 1-n are independent IPs.
Address spaces (independent networks), which are private address spaces. These independent IP address spaces 1-1, 1-2, ..., 1-n are connected to one management network 2 via the management network address conversion means 10.

Each independent IP address space 1-1, 1-2,
, 1-n are permitted to be assigned arbitrary private addresses, and as a result, there is a possibility that IP addresses may overlap in different independent IP address spaces. Incidentally, each independent IP address space 1-1, 1-
Since 2, ..., 1-n have a common configuration, they are simply described as the independent IP address space 1 in the following description.

Further, each independent IP address space 1
Then, V (Virtua) of the IEEE802.1Q compatible frame is
l: virtual) LAN is configured. This VLAN is a technology for virtually realizing the same LAN between different networks by using a VLAN tag in a frame header described later. FIG. 2 is an explanatory diagram of a VLAN-ID compatible frame header. VLAN as shown
-In the frame header corresponding to the ID, the destination address and the source address are followed by a 32-bit length VLAN tag (V
LAN-ID) is given. The VLAN tag is identification information indicating which group (independent IP address spaces 1-1, 1-2, ..., 1-n) the terminal belongs to in the VLAN, and is used by the management network address conversion means 10 described later. The switching hub 12 is this VLAN
It is designed to perform switching based on tags.
As a result, even different networks can be handled as if they were the same LAN.

Returning to FIG. 1, the management network 2 is an address space provided with a unique IP address, and is a network such as the Internet.

Management network address conversion means 10
Is a combination of the VLAN tag and the private address of each independent IP address space 1 for communication data having a VLAN tag as identification information for identifying the independent IP address space 1. It has a function to perform mutual conversion with other addresses and supports SNMP with duplicate IP addresses.
It consists of a proxy 11 and a switching hub 12. Duplication I
The P-address compatible SNMP proxy 11 performs mutual conversion with the address of the management network 2 based on the combination (pair) of the VLAN tag of the packet switched by the switching hub 12 and the private address of the independent IP address space 1. It is an address translation device.
This duplicate IP address-compatible SNMP proxy 11
The P address correspondence table 111, the management network IP search processing unit 112, and the data conversion unit 113 are included. The IP address correspondence table 111 is a table showing a correspondence relationship among the private address of the independent IP address space 1, the VLAN-ID, and the management network address. FIG. 3 is an explanatory diagram of the IP address correspondence table. In the illustrated example, for example, private address "192.168.4.1"
, The VLAN-ID is "K1" on one side and the VLAN-ID on the other side is "K2", so that they are unique management network addresses "***. 10.10.1" and "**" respectively. * .10.10.2 ”is associated.

Management network IP search processing unit 112
When the packet including the VLAN-ID is transmitted from the switching hub 12, the IP address correspondence table 111
Source IP address and VLA recorded in
It has a function of searching the management network address by referring to both the value of the N-ID. Data converter 11
A functional unit 3 converts the IP address portion of the TCP packet and the IP address portion of the SNMP datagram (PDU) according to the search result of the management network IP search processing unit 112.

The switching hub 12 is a VLAN-ID
It is a switching hub for switching corresponding packets, and when the destination address is the address of the management network 2, it is sent to the SNMP proxy 11 corresponding to the duplicate IP address, and when it is the private address of the independent IP address space 1, it is normal. It has a switching function.

<Operation> Fault information from the managed node (independent IP address space 1) is sent as an SNMP trap to the duplicate IP address-compatible SNMP proxy 11 via the switching hub 12. As a result, the duplicate IP address-compatible SNMP proxy 11 performs the following processing.

FIG. 4 is an operational flowchart of the duplicate IP address-compatible SNMP proxy 11. First, the management network IP search processing unit 112 analyzes the request and
Collate with the P address correspondence table 111 (step S
1). If this response is a request set in the IP address correspondence table 111, that is, if it is a VLAN-ID correspondence frame (step S2), the management network IP search processing unit 112 is recorded in the IP address correspondence table 111. By referring to both the trap transmission source IP address and the value of VLAN-ID, from the IP address correspondence table 111, the VL
The IP address of the management network is selected by using the correspondence between the value of the AN-ID and the IP address of the trap transmission source (step S3). Next, the data conversion unit 113
For the address of the management network 2 selected by the management network IP search processing unit 112, the IP address of the IP header part in the packet, and the SNMP PDU.
The IP address part of is converted and sent as an SNMP trap to the destination IP address (step S4). FIG. 5 is an explanatory diagram of IP address rewriting. As shown in the figure, the duplicate IP address-compatible SNMP proxy 11
The IP address of the P packet and the IP address of the payload are rewritten to the IP address of the management network 2 and output. In step S2, if the received frame is not a VLAN-ID compatible frame, it is simply discarded (step S5). However, this is one of the error handling implementation methods, and other error handling may be used.

<Effect> As described above, according to the first specific example, in the IP packets transmitted from the independent IP address spaces 1-1, 1-2, ..., 1-n by the management network address conversion means 10. IP header and SNMP PD
Since the IP address part of U is converted into the IP address of the management network 2, it is possible to provide the network management function only by one management network address conversion means 10 to the network having a plurality of independent IP addresses. There is an effect that can be done.

<Specific Example 2> In the specific example 2, an address converting means for converting a duplicate IP address into a unique address, and an SNM in an IP packet with the converted address.
A management network address converter for rewriting the IP address of P is provided.

<Structure> FIG. 6 is a structural diagram of the second specific example. In the figure, independent IP address spaces 1-1, 1-
2, ..., 1-n and the management network 2 are the same as in the first specific example. In this specific example, the independent IP address space 1-
1, 1-2, ..., 1-n (hereinafter, simply referred to as an independent IP address space 1) are connected to the management network 2 via an address conversion unit 20 and a management network address converter 30. The address conversion means 20 uses the duplicate I
It is composed of a proxy 21 corresponding to P address and a switching hub 22. The address translation unit 20 mutually translates the private data and the global address into the communication data having the VLAN tag as the identification information for identifying each independent IP address space 1 by the combination of the VLAN tag and the private address. It has a function of performing. The duplicate IP address-compatible proxy 21 uses the V of the packet switched by the switching hub 22.
An IP address conversion device that performs mutual conversion with a global address on the side of the management network 2 based on a combination (pair) of a LAN tag and a private address of the independent IP address space 1, and a conversion not shown for this mutual conversion. Have a table. Further, the switching hub 22 is a switching hub for switching packets corresponding to the VLAN-ID, like the switching hub 12 in the first specific example. When the destination address is the global address, the duplicate IP address corresponding proxy 21 is used. In addition, when it is a private address, it has a function of performing normal switching.

Management network address converter 30
Is a processing unit that performs conversion so that the IP address portion of the SNMP PDU of the IP packet whose address has been translated by the address translation unit 20 matches the IP address in the IP header. Become. The data comparison unit 31 uses the IP address converted by the duplicate IP address-compatible proxy 21 and the SNMP PDU.
It is a functional unit that compares the IP address parts of and determines whether or not they match. The data conversion unit 32 is a functional unit that performs processing of rewriting the IP address portion of the SNMP PDU with the IP address of the IP header when the IP addresses do not match in the data comparison unit 31.

<Operation> Fault information from the managed node (independent IP address space 1) is sent as an SNMP trap to the duplicate IP address corresponding proxy 21 via the switching hub 12. This allows duplicate I
The P-address corresponding proxy 21 performs NAPT processing and sends it to the management network address converter 30. As a result, the management network address converter 30 performs the following processing.

FIG. 7 is an operation flowchart of the management network address converter 30. First, the data comparison unit 31 of the management network address converter 30.
Analyzes the data packet and compares the IP address part of the IP packet with the IP address part of the SNMP PDU (step S11). By this comparison, I
When the P address is different (step S12), the data conversion unit 32 rewrites the IP address value of the SNMP PDU with the IP address value of the IP packet, and the SN
It is sent to the destination IP address as an MP trap (step S13). On the other hand, in step S12, the IP
Value of IP address of packet and IP of SNMP PDU
If the values of the addresses match, the management network address converter 30 does not perform the conversion process, but sends them as they are to the destination IP address.

<Effect> As described above, according to the second specific example, the address converting means 20 causes the independent IP address space 1
, 1-2, ..., 1-n, the IP address of the IP header of the IP packet is converted to the IP address of the management network 2, and the management network address converter 30 uses the converted IP address. SNMP
Since the IP address portion of the PDU is rewritten, it is possible to provide the network management function to the network having a plurality of independent IP addresses by using only one address conversion unit 20 and management network address converter 30. In particular, in advance, the address translation means 2
If the system has the function of 0, there is an effect that such a network management function can be realized only by adding the management network address converter 30.

<< Usage pattern >> In each of the specific examples described above, the VLAN-ID is used as the information for identifying the independent IP address spaces 1-1, 1-2, ..., 1-n. It is not limited to this information. For example,
Identification information such as an MPLS label in an MPLS (Multi Protocol Label Switching) network can also be applied in the same manner. In this way, each independent IP address space 1-1, 1
Any information can be applied as long as the information is unique to -2, ..., 1-n.

In each specific example, the IP address is used as the address of the specific protocol, but the present invention is not limited to this, and any protocol can be applied as long as it is an address used in an arbitrary network. Is.

Further, in each of the above specific examples, the management network 2 is described as a global address space, but it may be a private address space as long as the management network 2 does not permit overlapping addresses.

[Brief description of drawings]

FIG. 1 is a configuration diagram showing a specific example 1 of a duplicate network address translation system of the present invention.

FIG. 2 is an explanatory diagram of a VLAN-ID compatible frame header.

FIG. 3 is an explanatory diagram of an IP address correspondence table.

FIG. 4 is an operation flowchart of the duplicate IP address-compatible SNMP proxy 11.

FIG. 5 is an explanatory diagram of IP address rewriting.

FIG. 6 is a configuration diagram showing a specific example 2 of the duplicate network address translation system of the present invention.

FIG. 7 is an operation flowchart of a management network address converter.

[Explanation of symbols]

1-1, 1-2, ..., 1-n Independent IP address space (network) 2 Management network 10 Management network address conversion means 20 Address conversion means 30 Management network address converter

Claims (3)

[Claims] 1. A duplicated network address conversion system for connecting a plurality of networks, each of which allows overlapping of addresses between independent networks, and a management network for providing a network management service, wherein: Management network address conversion means for converting the addresses of the plurality of networks into the addresses of the management network by a combination of the identification information and the address of the network for communication data having identification information for identifying the network. A duplicate network address translation system characterized by being provided. 2. The duplicate network address translation system according to claim 1, wherein the network address in the communication data and the SNM.
An overlapping network address conversion system comprising a management network address conversion means for converting a network address portion of P into an address of a management network. 3. A duplicate network address conversion system for connecting a plurality of networks, each of which allows overlapping of addresses between independent networks, and a management network for providing a network management service, wherein: Address conversion means for converting communication data having identification information for identifying a network into addresses that do not overlap in the management network with a combination of the identification information and the address of the network. And a management network address converter for converting the address portion of the SNMP in the communication data so as to match the network address converted by the address conversion means. Temu.