WO2013069133A1 - Frame relay apparatus, communication system, and data transfer method - Google Patents

Abstract

The control unit of a frame relay apparatus (2) uses, as a search key, a VSANID or VLANID, which is determined from a transferred frame (7) received from an end node (3) of transmission source, to search a policy level table (23), thereby acquiring, as a search result, a policy level. Then, according to the information of a policy stored in a policy setting table (24) and corresponding to the acquired policy level, the control unit transfers the received transferred frame (7) to a frame relay apparatus (2) of a path leading to an end node (3) that is a transmission destination. It should be noted that VSANIDs and VLANIDs have been established, as the virtual networks of respective tenants, in a data network (8).

Description

Frame relay device, communication system, and data transfer method

The present invention relates to frame relay devices, communication systems, and techniques of data transfer methods.

A data center including a server device, a storage control device (storage device), and a frame relay device mainly constitutes two types of networks, SAN (Storage Area Network) and LAN (Local Area Network). The SAN is used, for example, when the server device reads and writes data from and in logical volumes in the storage device. The LAN is used, for example, for management communication.

There are several types of SANs. For example, a SAN using FC (Fibre Channel) protocol is called FC-SAN, and a SAN using FCoE (Fibre Channel over Ethernet) protocol is called FCoE-SAN. Also, a SAN in which a protocol such as iSCSI (Internet Small Computer System Interface) or NFS (Network File System) is used is called IP (Internet Protocol) -SAN. Ethernet is a registered trademark.

In SAN, a frame intended for communication with a storage device is used. The frame used in the SAN is hereinafter referred to as a SAN frame. In LAN, a communication protocol such as IP is used. The frame used in the LAN is hereinafter referred to as a LAN frame.
The communication port for transmitting and receiving the SAN frame and the communication port for transmitting and receiving the LAN frame are generally separate, and there is no mixture of SAN frame and LAN frame.

The name IP-SAN is derived from the use of TCP (Transmission Control Protocol) and IP protocol, such as iSCSI. Therefore, the frame distributed to the IP-SAN is a LAN frame having a side that is a SAN frame. However, as far as IP is used, it is a LAN frame, which is transmitted and received at the communication port for the LAN frame.

In recent years, for example, in a data center platform, DCB (Data Center Bridging) may be used for L2 (layer 2) communication between devices. Here, the DCB is Ethernet (registered trademark) extended to handle SAN frames and LAN frames with a common communication port. A protocol extended to handle FC with a common communication port is FCoE.

In DCB, different communication networks such as LAN and SAN can be integrated and operated. Therefore, in a data center or the like that uses the DCB, the LAN frame and the SAN frame are transmitted and received via the common communication port. For this reason, SAN frames and LAN frames are mixedly flowing on the same communication line.
That is, by integration of LAN and SAN, FCoE-SAN and IP-SAN can be configured using the same communication line.

On the other hand, with data centers, virtualization technologies such as servers and storage have been introduced, and there is a trend toward larger scale. Large-scale data centers are used, for example, as the basis of public clouds. Data centers used as the basis of public clouds are required to be compatible with multi-tenancy. The tenant here means, for example, a company that uses a data center.

The data center provider lends the resources of the data center to the tenant in physical device units such as server devices and storage devices, or in logical units such as virtual machines and logical volumes. In addition, along with the lending of those, we will also lend network resources such as communication bandwidth. Multi-tenant is a business model that lends such data center resources to multiple companies and earns revenue.

The amount and quality of resources required for each tenant varies. For example, a tenant requires 10000 virtual machines and 2000 logical volumes, and a storage apparatus that controls logical volumes needs to support iSCSI. On the other hand, the other tenants require 5000 virtual machines and 1500 logical volumes, and storage that controls the logical volumes needs to be compatible with FCoE.

At this time, depending on the type of protocol supported by storage, such as FCoE or iSCSI, the required level of network policy varies. For example, FCoE is a protocol that is used with emphasis on reliability compared to iSCSI. Therefore, tenants using FCoE storage place importance on reliability, and such tenants are provided with a policy of allocating high bandwidth and setting a high transfer priority so that reliability can be guaranteed. It must be done. To provide different policies for different types of storage, FCoE-SAN, IP-SAN, and LAN configured on the same line must be virtualized (logically divided) as different networks.

Furthermore, for example, even with tenants using iSCSI storage, a tenant with many storage accesses requires high bandwidth, but a tenant with few accesses does not require high bandwidth. In such a case, it is desirable to be able to optimize network resources to be lent, such as allocating high bandwidth to tenants requiring high bandwidth and allocating low bandwidth to tenants not requiring high bandwidth.

As described above, in order for the data center to support multi-tenancy, the network must be virtualized into SAN and LAN, and then SAN must be virtualized for each storage protocol. Then, it is necessary to provide the virtualized networks with the policies required by the tenant.

Therefore, there is known a method and apparatus capable of virtualizing a SAN using VSAN (Virtual SAN), specifying a VSAN to which a transmission source device belongs from a transfer frame, and specifying a policy according to the network (Patent Document 1). .
Furthermore, a method has been announced in which a network is virtualized by VLAN (Virtual LAN) for each tenant, and different policies are assigned to each tenant (Non-Patent Document 1).

Japanese Patent Application Publication No. 2005-514862

Cisco Systems, Inc., "Designing a Secure Multi-Tenant Environment in a Virtual Data Center", [online], [September 22, 2011 Search], Internet <URL: http://www.cisco.com/ web / JP / solution / netsol / designzone / datacenter / literature / pdf / SecureMultiTenancy_DesignGuide_Ja.pdf>

The respective network virtualization technologies such as Patent Document 1 and Non-Patent Document 1 do not assume an integrated network in which a plurality of SANs of different types and a LAN are configured by the same line. Therefore, even if network resources are allocated according to these virtualization methods, it is not possible to provide a policy required by a tenant to a plurality of SANs of different types.

That is, in order to provide a cloud service utilizing network resources on the integrated network, simply applying a plurality of virtualization methods as it is to the integrated network can not efficiently allocate network resources on the integrated network. .
Therefore, it is necessary to define a policy level used for communication for each virtualization method, and to transfer a frame according to the policy level. If the policy level is designed on the assumption that there are a plurality of virtualization methods in advance, network resources of the integrated network can be provided without loss over the virtualization methods.

Therefore, it is an object of the present invention to solve the above-mentioned problems and to determine a policy for transferring a packet according to a virtualization scheme on an integrated network in which a plurality of virtualization schemes are shared by the same line. It is the main purpose.

In order to solve the problems, the present invention is connected to a data network that performs data communication of a SAN (Storage Area Network) and data communication of a LAN (Local Area Network) using the same physical line, A communication interface unit that relays communication with each source and destination end node of a transfer frame to be transferred;
A storage unit for storing a VSAN ID specifying a virtual network used for data communication of the SAN and a VLAN ID for specifying a virtual network used for data communication of the LAN;
Policy level storage in which a policy level table indicating policy levels referenced as data indicating the degree of utilization of resources of the data network when relaying the transfer frame is associated with each of the VSANID and the VLANID Department,
The policy level which is a search result is acquired by searching the policy level table using the VSANID or the VLANID specified from the transfer frame received from the end node of the transmission source as a search key,
And a control unit for transferring the received transfer frame to a route toward the destination end node in accordance with the policy content at the policy level, and relaying the transfer frame.
Other means will be described later.

According to the present invention, it is possible to determine a policy for transferring a packet according to a virtualization scheme on an integrated network in which a plurality of virtualization schemes are shared by the same line.

FIG. 1 is a block diagram showing a communication system according to an embodiment of the present invention. FIG. 2 is a block diagram showing details of each end node shown in FIG. 1 according to an embodiment of the present invention. It is a block diagram which shows the detail of the management apparatus and frame relay apparatus which were shown in FIG. 1 regarding one Embodiment of this invention. It is an example of the GUI screen provided to the user regarding one Embodiment of this invention. It is a block diagram which shows the detail of the various tables shown in FIG. 3 regarding one Embodiment of this invention. It is a block diagram which shows the detail of the various tables shown in FIG. 3 regarding one Embodiment of this invention. 7 is an example of a transfer frame structure according to an embodiment of the present invention. It is a flowchart which shows the process of the data analysis part for control regarding one Embodiment of this invention. It is a flowchart which shows the process of the data insertion part for control regarding one Embodiment of this invention. It is an example which set VLANID and VSANID which can specify policy level uniquely concerning one embodiment of the present invention to an end node. FIG. 11 is a block diagram showing a policy level table corresponding to FIG. 10 according to an embodiment of the present invention.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a block diagram showing a communication system. The communication system includes a management device 1, a management network 9, a plurality of frame relay devices 2, a data network 8, and a plurality of end nodes 3.
The management network 9 is a network connecting the management device 1 and each frame relay device 2, and data for management from the management device 1 to each frame relay device 2 is transmitted. Therefore, the management apparatus 1 displays and edits a management screen 1a (see FIG. 4 for details) for causing the administrator to create management data.
The frame relay device 2 can interpret the control data attached to the transfer frame 7 from the end node 3 by setting management data from the management device 1, and the level of the policy according to the interpretation can be obtained. Transfer frame 7 is transferred.

The data network 8 is a network that connects the frame relay devices 2 and is used to relay data communication between the end nodes 3 accommodated by the frame relay device 2 as exemplified by the broken arrows in FIG.

The frame relay device 2 is classified into AG-SW (Aggregation-Switch) and ToR-SW (Top of Rack-Switch).
AG-SWs (Aggregation-Switch) 2a and 2b are switches corresponding to link aggregation in which a plurality of physical lines are bundled and logically treated as one line.
The ToR-SW (Top of Rack-Switch) 2c, 2d is a switch housed together with the end node 3 for each rack (shelf), and is connected to the end node 3 arranged in the same rack.
In FIG. 1, as the data network 8, the AG-SWs 2a and 2b and the ToR-SWs 2c and 2d are connected by full mesh.

The end node 3 is a device accommodated (directly connected) in one frame relay device 2, and the server device 3a, the FCoE storage device 3b, and the iSCSI storage device 3c are illustrated.
The end node 3 is classified into an apparatus that transfers data using a LAN frame and an apparatus that transfers data using a SAN frame. The data network 8 is a network in which both LAN frames and SAN frames are transmitted by the same physical medium (physical line), in other words, an integrated network of LAN and SAN.

FIG. 2 is a block diagram showing details of each end node 3 shown in FIG. In FIG. 2, VLANID (3 digits) or VSANID (4 digits) are written together as an ID (assigned) that belongs (assigned) in the unit of each component inside each component. For example, a NIC (Network Interface Card) 313 belongs to two VLANs (VLAN ID = 100, 200).

The server apparatus 3a in FIG. 2A includes a CNA (Converged Network Adapter) 311, a VM (Virtual Machine) control software 314, a VHBA (Virtual Host Bus Adapter) 315 and 318, and a VNIC (Virtual Network Interface) 316, 319 and VMs 317 and 320.
The CNA 311 includes an HBA (Host Bus Adapter) 312 and an NIC 313.
The VM control software 314 controls the VHBAs 315 and 318, the VNICs 316 and 319, and the VMs 317 and 320. Alternatively, control of the VHBAs 315 and 318 and the VNICs 316 and 319 may be performed by the CNA 311 (including the HBA 312 and the NIC 313).

The FCoE storage device 3 b of FIG. 2B includes a network interface 322, an FCoE target 323, and LUs (Logical Units) 324 and 325.
The FCoE target 323 processes the target of the FCoE protocol defined by ANSI INCITS T11. LUs (Logical Units) 324 and 325 are logical storage devices used by the VMs 317 and 320.

The iSCSI storage device 3c of FIG. 2B includes a Network Interface 327, iSCSI targets 328 and 329, and LUs (Logical Units) 330 and 331.
The iSCSI targets 328 and 329 perform processing on an iSCSI target defined by RFC (Request For Comment) 3720 or the like. The LUs 330 and 331 are logical storage devices used by the VMs 317 and 320.

FIG. 3 is a block diagram showing the details of the management device 1 and the frame relay device 2 shown in FIG.
The management device 1 includes a CPU 61, a memory 62, a bus 63, an auxiliary storage device 64, an input unit 65, a network interface 66, and an output unit 67.

The CPU 61 reads and executes a program stored in the auxiliary storage device 64. The CPU 61 executes the computer program while storing in the memory 62 the intermediate result and the completion result of the calculation at the time of program execution.
The memory 62 is, for example, a storage device such as a dynamic random access memory (DRAM).
The bus 63 is a transmission path that interconnects the CPU 61, the memory 62, the auxiliary storage device 64, the input unit 65, the network interface 66, and the output unit 67, and transmits their input / output signals.
The input unit 65 is configured of, for example, a device such as a keyboard or a mouse, and sends the input of the user of the management terminal to the CPU 61.
The network interface 66 is configured of, for example, a device such as a NIC, and is connected to the management communication port 75 of the frame relay device 2 via the management network 9.
The output unit 67 is configured of, for example, a device such as a display, and notifies the user of the management device of the execution result of the program.

The auxiliary storage device 64 is, for example, a storage device such as a flash memory or a hard disc drive (HDD). The auxiliary storage device 64 includes, for example, an operating system (not shown), a program of the user interface unit 11, and various tables (tenant data input table 21, policy level input table 22, policy level table 23, policy setting table 24). , Protocol filter table 25).
The user interface unit 11 provides the user of the management apparatus with editing means such as data registration and data deletion as various commands such as CLI (Command Line Interface) and GUI (Graphical User Interface) for various tables.

The input tables (tenant data input table 21 and policy level input table 22) among the various tables store values input by the user of the management terminal (e.g., the provider of the data center).
Among the various tables, the tables other than the input table (policy level table 23, policy setting table 24, protocol filter table 25) store input values from the user of the management terminal and values generated from the input table Thus, the management device 1 notifies (copies) the frame relay device 2.
Furthermore, although not shown in FIG. 3, the management apparatus 1 may notify (copy) other data for management (packet filter and transfer rule) to the frame relay apparatus 2.

The frame relay device 2 includes a CPU 71, a memory 72, a bus 73, an auxiliary storage device 74, a management communication port 75, a switching unit 76, and a plurality of communication ports 77.
The CPU 71 reads and executes each program stored in the auxiliary storage device 74. The CPU 71 executes the computer program while storing in the memory 72 the intermediate result and the completion result of the calculation at the time of program execution.
The memory 72 may be similar to the memory 62 and is, for example, a storage device such as a dynamic random access memory (DRAM).
The bus 73 is a transmission path that interconnects the switching unit 76, the CPU 71, the memory 72, the management communication port 75, and the auxiliary storage device 74, and transmits their input / output signals.
The management communication port 75 is a port connected to the management network 9.

The auxiliary storage device 74 is, for example, a storage device such as a flash memory or an HDD (Hard Disc Drive). The auxiliary storage device 74 stores, for example, programs for an operating system (not shown) and each control unit (control data analysis unit 12, control data insertion unit 13, control data exclusion unit 14).
The control data analysis unit 12 analyzes the control data stored in the transfer frame 7, extracts the policy level corresponding to the analyzed ID, and collates the policy setting table 24 to transfer the frame. The policy to apply is specified (details are shown in FIG. 8).
The control data insertion unit 13 is activated by an instruction from the control data analysis unit 12 and inserts control data into the transfer frame 7 (details are shown in FIG. 9).
The control data exclusion unit 14 is activated by an instruction from the control data analysis unit 12 and removes the control data from the transfer frame 7 (for details, FIG. 8).

Further, the auxiliary storage device 74 also stores a policy level table 23 received from the management device 1, a policy setting table 24, and a protocol filter table 25. The contents (12, 13, 14, 23, 24, 25) of the auxiliary storage device 74 may be provided inside the switching unit 76.

The switching unit 76 receives a frame from each communication port 77, transmits a frame to each communication port 77, controls transmission and reception of a frame, and the like. For example, the switching unit 76 can execute control defined by each communication protocol, such as DCB defined by IEEE802.1 qau or FCoE defined by ANSI INCITS T11, according to the type of frame. Also, it is possible to recognize a frame including two stages of tags defined by IEEE802.ad. Furthermore, the switching unit 76 has a function of discarding an unanalyzable frame or passing it to the CPU 71.
The communication port 77 is a port physically connected to another network device (frame relay device 2, end node 3).

FIG. 4 is an example of a GUI screen provided to the user through the output unit 67 by the user interface unit 11. The management screen 1a is a screen operated by a user of the management apparatus (for example, a business operator of a data center) to set a policy level in accordance with a tenant request. The user interface unit 11 updates the various tables shown in FIG. 3 based on input values from the user on the management screen 1a.

The management screen 1a includes, for example, a tenant name input field 402, a LAN level input field 403, a SAN1 type input field 404, a SAN1 level input field 405, a SAN2 type input field 406, and a SAN2 level input field 407. .
The tenant name input field 402 is a field for inputting the name of the tenant (for example, "tenant A").
The LAN level input field 403 is a field for inputting the level of policy applied when the tenant uses the LAN. Here, the policy level shows high values in the order of High, Middle, and Low, and "High" surrounded by a square is selected (the other fields are similarly selected) ).
The SAN1 type input field 404 is a field for inputting the first type of storage used by the tenant. If not input, the storage may not be used.
The SAN1 level input field 405 is a field for inputting the level of policy when using SAN1 type storage.
The SAN2 type input field 406 is a field for inputting the second type of storage used by the tenant.
The SAN2 level input field 407 is a field for inputting the level of policy when using SAN2 type storage.

5 and 6 are configuration diagrams showing details of various tables shown in FIG.
FIG. 5A shows a configuration example of the tenant data input table 21. As shown in FIG. The tenant data input table 21 includes a tenant name 100, a LAN level 101, an FCoE level 102, an iSCSI level 103, and a tenant ID 104.

The tenant name 100 is a field for holding the name of the tenant. In this field, the user interface unit 11 stores the value input in the tenant name input field 402 of the management screen 1a.

The LAN level 101 holds the level of policy applied when the tenant uses the LAN. In this field, the user interface unit 11 stores the value input in the LAN level input field 403 of the management screen 1a. Hereinafter, each input value (tenant A etc.) shown in FIG. 4 corresponds to the record value of the first line of the tenant data input table 21 of FIG. 5 (a).

The FCoE level 102 holds the level of policy when a tenant uses FCoE storage. This field is stored in the SAN1 level input field 405 or the SAN2 level input field 407 when the user interface unit 11 enters the FCoE in the SAN1 type input field 404 or the SAN2 type input field 406 of the management screen 1a. Stores the entered value.

The iSCSI level 103 holds the level of policy when the tenant uses FCoE storage. This field is stored in the SAN1 level input field 405 or the SAN2 level input field 407 when the user interface unit 11 inputs iSCSI in the SAN1 type input field 404 or the SAN2 type input field 406 of the management screen 1a. Stores the entered value.

The tenant ID 104 holds the ID of the tenant. The tenant ID is issued as a VLAN ID (three-digit numerical value in the present embodiment), a VSANID (four-digit numerical value in the present embodiment), or any other value. For example, the user interface unit 11 collates the LAN level 101 with the policy level 112 of the policy level input table 22, and, among the IDs 111 corresponding to the matching policy levels, the VLANID not assigned to the tenant ID is a new tenant Issue as an ID.
The tenant A (tenant ID 104 "100") uses the VM 317 using the VNIC 316 (VLAN ID = 100), and the tenant B (tenant ID 104 "200") uses the VM 320 using the VNIC 319 (VLAN ID = 200) (FIG. 2) reference).

FIG. 5B shows a configuration example of the policy level input table 22. The policy level input table 22 includes an ID 111 and a policy level 112.
The ID 111 is a VLAN ID (three-digit numerical value) or a VSANID (four-digit numerical value) as a number (ID) identifying the virtualized network when the data network 8 allocated to the tenant is virtualized. .
The policy level 112 holds the level of the policy corresponding to the ID 111.

FIG. 6A shows a configuration example of the policy level table 23. The policy level table 23 includes a VLAN ID 120, an NW type 121, a VSAN ID 122, and a policy level 123.
The VLAN ID 120 is a number (ID) for identifying a VLAN when the data network 8 is virtualized as a VLAN. In the present embodiment, the VLAN ID 120 is used as the tenant ID 104. Also, a tenant may use a plurality of VLANIDs 120, while a single tenant may be configured as a single tenant using all VLANIDs 120. The NW type 121 means the type of network.
The VSAN ID 122 is a number (ID) for identifying the VSAN when the data network 8 is virtualized as a VSAN.
The policy level 123 means the policy level for each NW type 121.

The user interface unit 11 stores policy level data (LAN level 101, FCoE level 102, iSCSI level 103) in the tenant data input table 21, and a combination of the stored data and the storage destination (for example, LAN level) The policy level 123 "LAN-High" is specified by connecting "high" to 101).
The record in the first line of the policy level table 23 is for the user of tenant A (tenant ID = VLANID = 100), the policy level “LAN-High” of LAN (VLANID = 100) and SAN (VSANID = 1400) It shows that the policy level “iSCSI-Middle” and the policy level “FCoE-High” of SAN (VSANID = 1000) are respectively assigned.

FIG. 6B shows a configuration example of the policy setting table 24. The policy setting table 24 is a table for managing the policy for each policy level 131. The data content of the policy setting table 24 is set in advance as a management parameter via the user interface unit 11 by a network administrator or the like.

The policy setting table 24 includes a policy ID 130, a policy level 131, and DCB control parameters (priority 132 and allocated bandwidth 133) which are the contents of the policy. As the content of the policy, not only the priority 132 and the allocated bandwidth 133 but also other parameters may be defined and used at the time of transfer. Moreover, it is good also as a parameter of the system which controls policies other than DCB.
The policy ID 130 is an identification number of the policy level 131.
The priority 131 means the transfer priority for each policy level. For example, FIG. 6B shows an example in which FCoE has the highest priority, followed by iSCSI and LAN, which have the lowest priority.
The allocated bandwidth 133 means the ratio of the communication bandwidth to be allocated to the policy level. For example, in FIG. 6B, the ratio of the band that can most be used by FCoE-High is 30%.

The switching unit 76 performs transfer processing of the transfer frame 7 to which the policy is applied, using the DCB control parameters of the policy setting table 24 as described below.
Set the value of priority 132 to PFC (Priority Base Control), which is one of DCB functions. The switching unit 76 has, for example, a transmission queue for each value of the priority 132.
Set the value of the allocated bandwidth 133 to ETS (Enhanced Transmission Selection) which is one of DCB functions. The switching unit 76 determines the number of transfer frames 7 to be taken out for transmission from the transmission queue, for example, at a frequency corresponding to the ratio of the allocated bandwidth 133.

FIG. 6C shows a configuration example of the protocol filter table 25. The protocol filter table 25 is referred to from the control data insertion unit 13 in order to specify a network protocol (a protocol constituting an IP-SAN) used for transmission of the transfer frame 7. The data content of the protocol filter table 25 is also set in advance as a management parameter via the user interface unit 11 by the network administrator or the like.

The protocol filter table 25 includes a protocol type 140, a storage port number 141, and an NW type 142.
The protocol type 140 holds a number identifying the protocol. For example, “0x06” is a TCP protocol number, which is a number stored in the protocol type field of the IP header.
The storage port number 141 means a port number used by the storage. The port number here is not a physical port number but an identification number of a specific application. The port number is stored and used in the TCP header. For example, “0x3260” is a representative port number used for the NW type 142 “iSCSI”. In addition, iSCSI is an example to the last, and it is possible to set a port number that means another storage protocol.

FIG. 7 is an example of the structure of the transfer frame 7. In FIG. 7, a code (for example, “201”) is shown in parentheses after the data content (for example, “Destination Address”).
The transfer frame 7 includes a destination address field 201, a source address field 202, a C-tag 213, an S-tag 214, an ether type field 211, and a payload 212. The destination address field 201, the source address field 202, and the ether type 211 may have the same meaning and usage as the Ethernet frame fields defined by IEEE 802.3.

In the transfer frame 7, for example, two-stage tags (C-Tag 213 and S-Tag 214) can be set by using a protocol such as IEEE 802.1 ad or IEEE 802.1 ah. The following shows an example of using IEEE802.1ad.
C-Tag 213 and S-Tag 214 are both composed of TPID fields 203 and 207, User Priority fields 204 and 208, CFI fields 205 and 209, and 12-bit VID fields 206 and 210. These fields are defined by IEEE802.1ad, and the description will be omitted. Also, the VID fields 206 and 210 are denoted by reference numerals 215 to 226 in order from the most significant bit of the 12 bits.

In the following description, the policy ID 130 is stored in the VID field 206 and the tenant ID 104 is stored in the VID field 210 as control data stored in the transfer frame 7. However, the policy ID 130 and the tenant ID 104 are stored. The position is not particularly limited, and various implementations are possible (for example, an implementation in which both the policy ID 130 and the tenant ID 104 are stored in the payload 212).
In addition, when the FCoE storage device 3b is the destination, the storage destination of the VSANID is already defined in the FCoE protocol, so the tenant ID 104 may be stored not in the VID field 210 but in the storage destination of the FCoE protocol VSANID. .

Hereinafter, data transfer processing according to the tenant policy by the communication system shown in FIGS. 1 to 7 will be described with reference to the flowcharts of FIGS. 8 and 9. In the description of the flowchart, as an example of the path of the transfer frame 7, reference is made to the path of the broken arrow shown in FIG. 1 (server device 3a → ToR-SW2c → AG-SW2b → ToR-SW2d → iSCSI storage device 3c). .

FIG. 8 is a flowchart showing the processing of the control data analysis unit 12.

First, when the control data analysis unit 12 receives the transfer frame 7 (S101), the frame relay apparatus 2 of its own transmits the transfer frame 7 from the control data (policy ID, tenant ID) attached to the transfer frame 7. In the above path, it is specified which position (which role) it is (S102). The following is the role of the frame relay device 2.

Role “Ingress SW (for example, ToR-SW 2 c)”: The frame relay device 2 located at the entrance of the data network 8 when the transfer frame 7 first flows into the data network 8. In other words, it can be said that the frame relay device 2 accommodates the server device 3 a that is the transmission source of the transfer frame 7.
When transmitting the transfer frame 7 to another frame relay device 2, the frame relay device 2 adds the policy ID to the transfer frame 7 as control data. Therefore, it is determined that the frame relay device 2 that does not contain the policy ID as control data of the transfer frame 7 and does not accommodate the end node 3 that is the destination of the transfer frame 7 corresponds to the “ingress SW”. And proceed to S113.

As to whether or not the end node 3 serving as the destination is accommodated by itself, for example, the following means provided in the frame relay device 2 is used. For example, by using LLDP (Link Layer Discovery Protocol) defined by IEEE802.1AB or Data Center Bridging Capability Exchange Protocol (DCBX) defined by IEEE802.1DCB, the type of device connected to each port of the own station is identified. Keep it. According to this means, if the device connected to the port corresponding to the destination of the transfer frame 7 is the server device 3a or a storage device, it can be understood that it is addressed to the end node 3 directly connected to the own station.

Role “Core SW (for example, AG-SW 2 b)”: The frame relay device 2 on the path of the transfer frame 7 which is judged neither as the ingress SW nor the egress SW described later. Control data (policy ID, tenant ID) is attached to the transfer frame 7 received by the core SW. If the core SW is determined, the process proceeds to step S121.

Role “Exit SW (via NW, for example ToR-SW 2 d)”: A frame relay device 2 located at the exit of the data network 8 when the transfer frame 7 flows out from the data network 8 In other words, it can be said that the frame relay device 2 accommodates the iSCSI storage device 3 c which is the destination of the transfer frame 7.
It is specified that the destination end node 3 is accommodated by the means for determining whether or not the end node 3 serving as the destination indicated by the entrance SW is accommodated by itself, and the received transfer frame When the control data (policy ID, tenant ID) is attached to 7, it is determined that it is an exit SW (via NW), and the process proceeds to S111.

Role “Exit SW (not through NW)”: When performing local communication that is a route different from the route indicated by the dashed arrow in FIG. 1 but the transfer frame 7 does not pass through the data network 8 3b → ToR-SW 2 d → iSCSI storage device 3 c), a frame relay device 2 relaying the local communication. The frame relay device 2 that is the transfer frame 7 that does not include the policy ID in the control data and that accommodates the end node 3 that is the destination of the transfer frame 7 is “outgoing SW (without NW)”. It is judged that it corresponds, and it progresses to S112.

In S111, the control data analysis unit 12 instructs the control data removal unit 14 to exclude control data (policy ID, tenant ID) from the transfer frame 7. This is because the control data is data used for data transfer to which the policy in the data network 8 is applied, and is unnecessary outside the data network 8.
The control data exclusion unit 14 that has received the instruction excludes the C-Tag 213 storing the policy ID of the transfer frame 7 and the S-Tag 214 storing the tenant ID from the transfer frame 7 respectively.
In S112, the control data analysis unit 12 transfers the transfer frame 7, in which no control data exists, to the destination iSCSI storage device 3c through the switching unit 76 and the communication port 77.

In S113, the control data analysis unit 12 activates the control data insertion unit 13 in order to insert control data (policy ID, tenant ID) into the transfer frame 7. Details of the processing of the control data insertion unit 13 that has been started up will be described with reference to FIG.

In S121, the control data analysis unit 12 specifies a policy to be applied to transfer by referring to the policy ID 130 of the policy setting table 24 using the policy ID read from the C-Tag 213 of the transfer frame 7 as a search key. .
In S122, the control data analysis unit 12 causes the switching unit 76 to transfer the transfer frame 7 toward the destination according to the DCB control parameters (priority 132 and allocated bandwidth 133) which are the policies specified in S121.

FIG. 9 is a flowchart showing processing of the control data insertion unit 13.
As S201, the tenant ID of the transfer frame 7 is searched from the VLAN ID 120 and the VSAN ID 122 of the policy level table 23.
As S202, it is determined whether the tenant ID is searched from the VLAN ID in S201 or not (whether it is searched from the VSAN ID 122). If YES in S202, the process proceeds to S203, and if NO, the process proceeds to S207.

As S203, the NW type of the transfer frame 7 is searched from the protocol filter table 25. That is, the <protocol type, port number> set of the transfer frame 7 is extracted from the payload 212, and collated with the <protocol type 140, storage port number 141> set of the protocol filter table 25 to identify the corresponding NW type 142.
As S204, it is determined from the NW type 142 specified in S203 whether or not it is the transfer frame 7 addressed to the storage. If the result is "Yes" in S204 (for example, "iSCSI" is the storage address, then "Yes"), the process proceeds to S205, and if "No", the process proceeds to S207.

As S205, the tenant ID of the transfer frame 7 and the NW type 142 identified in S203 are collated with the <VLANID 120 and NW type 121> in the policy level table 23, and the corresponding policy level 123 is identified.
At S206, the policy level of the transfer frame 7 identified at S205 is searched from the policy level 131 of the policy setting table 24, and the corresponding policy (policy ID 130, priority 132, allocated bandwidth 133) is identified.

As S207, the policy level 123 in the record of the policy level table 23 searched in S201 is specified, and the policy level 123 is searched from the policy level 131 of the policy setting table 24, and the corresponding policy (priority 132, allocated bandwidth) 133).

At S208, the policy ID 130 identified at S206 is inserted into the transfer frame 7. If the maximum number of policy IDs is eight, it is possible to express the numerical values of policy IDs of 0 to 7 with 3-bit data. At that time, the insertion position of the policy ID may be, for example, the upper 3 bits (215 to 217) of the VID field 206, the lower 3 bits (224 to 226), or other 3 bits.
As S210, the transfer frame 7 is transferred in the same manner as S122 in accordance with the policy specified in S206 or S207.

As described above, according to the present embodiment described with reference to FIGS. 1 to 9, the policy level of the data network 8 used by the tenant can be specified, and data transfer can be performed according to the policy level.

Hereinafter, processing of data transfer according to the policy level will be described along the path of the dashed arrow in FIG. Table 1 shows an example of control data added to the transfer frame 7 in each link (the link position is specified by the combination of the transfer source and the transfer destination) on the path of the dashed arrow in FIG.

In the first line of Table 1, the VM 317 of the transmission source (server apparatus 3a) transmits the transfer frame 7 with its own tenant ID "100" to the entry SW (ToR-SW 2c) through the VNIC 316 and NIC 313. The ToR-SW 2 c identifies the transfer frame 7 from the tenant A by referring to the tenant ID “100” of the transfer frame 7.

In addition, instead of referring to the tenant ID "100", the tenant ID specific information (MAC address or IP address of end node 3, destination port number of end node 3, etc.) registered in advance in ToR-SW 2c The tenant ID of the transfer frame 7 to which the tenant ID is not attached may be specified by referring to.

In the second line of Table 1, the ToR-SW 2c transfers the policy ID “3” corresponding to the policy “iSCSI-Middle” because the destination of the transfer frame 7 is the iSCSI storage apparatus 3c not accommodated by itself. 7 and transmit to the core SW (AG-SW 2 b) heading to the destination.
At the time of this transmission, the ToR-SW 2c uses the network resource with the priority "3" and the allocation band "15%" according to the policy "iSCSI-Middle" set in the iSCSI of the tenant A in the policy level table 23.

In the third row of Table 1, the core SW (AG-SW 2 b) outputs an egress SW (heading transfer frame 7 to a destination) according to the policy “iSCSI-Middle” of policy ID “3” attached to the transfer frame 7 Send to ToR-SW2d).
In the fourth line of Table 1, the egress SW (ToR-SW 2 d) transfers control data (policy ID, tenant ID) attached to the transfer frame 7 to the destination (iSCSI storage device 3c) excluding the control data (policy ID, tenant ID) . The tenant ID may not be excluded.

Although the example of the system including the FCoE and the iSCSI storage is described above, the present invention is not limited to the configuration, and may be a configuration including storage of another protocol. For example, the configuration may be such that NFS storage is included in the system, in which case data for NFS is recorded in each table (21, 22, 23, 24, 25) according to the policy level of NFS for each tenant Data transfer is possible.

Furthermore, it is necessary to explicitly include the policy ID for specifying the policy level in the transfer frame 7 by using VLAN ID or VSAN ID that can uniquely identify the tenant ID and the policy level as the ID included in the transfer frame 7 There is no longer, and the control data of the transfer frame 7 handled by the control data insertion unit 13 and the control data removal unit 14 can be uniquely identified from one (the tenant ID and the policy level) out of two (policy ID and tenant ID). ID) can be reduced in weight.

FIG. 10 shows an example in which the VLAN ID and VSAN ID capable of uniquely identifying the policy level are set in the end node 3. For example, the VHBA 315 of FIG. 2 (a) is replaced with the VNIC 315 b of FIG. As "1400" is assigned.
FIG. 11 shows a policy level table 23 corresponding to FIG. Compared with the policy level table 23 of FIG. 6A, the difference is that the VLAN ID 120 (= tenant ID) and the policy level 123 can be uniquely identified from the VSAN ID 122.

In the embodiment described above, the management device 1 registers the policy level for each NW type in various tables such as the policy level table 23 in advance for each tenant specified by the tenant ID (VLAN ID or VSAN ID). Then, the frame relay device 2 performs data transfer according to the policy level applied to the transfer frame 7 by referring to the various tables notified from the management device 1.
As a result, data transfer corresponding to the policy level of the tenant LAN and various policy levels for each SAN type can be performed, and resources of the data network 8 can be efficiently used by the tenant.

1 management device 1a management screen 2 frame relay device 2a AG-SW
2b AG-SW
2c ToR-SW
2d ToR-SW
7 transfer frame 8 data network 9 management network 3 end node 3a server device 3b FCoE storage device 3c iSCSI storage device 11 user interface unit 12 control data analysis unit 13 control data insertion unit 14 control data exclusion unit 21 tenant data Input table 22 Policy level input table 23 Policy level table 24 Table for policy setting 25 Protocol filter table

Claims (7)

It is connected to a data network that performs SAN (Storage Area Network) data communication and LAN (Local Area Network) data communication using the same physical line, and is the source and destination of the transfer frame to be transferred. A communication interface unit that relays communication with each end node;
A storage unit for storing a VSAN ID specifying a virtual network used for data communication of the SAN and a VLAN ID for specifying a virtual network used for data communication of the LAN;
A policy level table is stored in which a policy level table indicating the level of the policy referred to as data indicating the degree of utilization of the resource of the data network when relaying the transfer frame is associated with each of the VSANID and the VLANID. A storage unit,
The policy level which is a search result is acquired by searching the policy level table using the VSANID or the VLANID specified from the transfer frame received from the end node of the transmission source as a search key,
A control unit that transfers the received transfer frame to a route toward the destination end node according to the policy content at the policy level, and relaying the transfer frame. The data communication is performed between a plurality of frame relay devices connected to a data network that performs data communication of SAN (Storage Area Network) and data communication of LAN (Local Area Network) using the same physical line. A communication system that performs data communication according to a policy level indicating a degree of utilization of resources of the network,
The virtual nodes used for data communication in the SAN for each end node that is the source and destination of the transfer frame transferred by the frame relay device, and for each frame relay device through which the transfer frame passes from the source to the destination While VSANID for specifying a network is set for each SAN protocol type for each tenant, at least one VLANID for specifying a virtual network used for LAN data communication is set for each tenant,
The storage means of the frame relay apparatus includes a policy level table indicating the corresponding policy level for each of the VSANID and the VLANID, and a policy content indicating utilization setting of the data network resource corresponding to the policy level. And a policy setting table shown in FIG.
The control unit of the frame relay device
The policy level which is a search result is acquired by searching the policy level table using the VSANID or the VLANID specified from the transfer frame received from the end node of the transmission source as a search key,
A communication system characterized in that the received transfer frame is transferred to the frame relay device on a route toward the end node as a destination according to the policy content corresponding to the policy level acquired in the policy setting table. . The control unit of the frame relay device
If it is determined that the received transfer frame does not include a policy ID for uniquely identifying the policy level, the policy ID specified for the transfer frame to be transferred to another frame relay device And attach a tenant ID for uniquely identifying the tenant of the transfer frame, and then transfer
If it is determined that the policy ID and the tenant ID are included in the received transfer frame,
When the self does not accommodate the destination end node, the transfer frame is transferred to another frame relay apparatus according to the policy content corresponding to the policy level specified from the already attached policy ID. Transfer
When the terminal itself accommodates the destination end node, it is characterized in that the policy ID and the tenant ID already attached are excluded from the transfer frame and then transferred to the destination end node. The communication system according to claim 2. The control unit of the frame relay device
If it is determined that the VSANID for uniquely identifying the policy level and the tenant is not included in the received forwarding frame, the VSANID for the forwarding frame to be forwarded to another frame relay device is determined. And then forward
If it is determined that the VSANID is included in the received transfer frame, further,
When the self does not accommodate the destination end node, the transfer frame is transferred to the other frame relay apparatus according to the policy content corresponding to the policy level specified from the VSANID already attached. And
When the terminal itself accommodates the destination end node, it removes the already assigned VSANID from the transfer frame and transfers it to the destination end node. The communication system described in the section. When the control unit of the frame relay device transfers the transfer frame according to the policy content, a DCB (Data Center Bridging) in which the switching unit of the frame relay device has a value of priority which is the first policy content 4) setting the PFC (Priority Base Control) of (1) and setting the value of the allocated bandwidth, which is the second policy content, to ETS (Enhanced Transmission Selection) of the DCB. 5. A communication system according to any one of clauses 4. It is connected to a data network that performs SAN (Storage Area Network) data communication and LAN (Local Area Network) data communication using the same physical line, and is the source and destination of the transfer frame to be transferred. A data transfer method executed by a frame relay apparatus including a communication interface unit that relays communication with each end node, a storage unit, and a control unit,
The storage unit is a VSAN ID that specifies a virtual network used for data communication of the SAN, with a policy level referred to as data indicating the degree of utilization of the resource of the data network when relaying the transfer frame; And a policy level table is stored, which is shown in association with each VLAN ID specifying a virtual network used for data communication of the LAN.
The control unit
The policy level which is a search result is acquired by searching the policy level table using the VSANID or the VLANID specified from the transfer frame received from the end node of the transmission source as a search key,
A data transfer method, comprising transferring the received transfer frame to a route toward the destination end node according to the policy content at the policy level. The data communication is performed between a plurality of frame relay devices connected to a data network that performs data communication of SAN (Storage Area Network) and data communication of LAN (Local Area Network) using the same physical line. A data transfer method by a communication system that performs data communication according to a policy level indicating a degree of utilization of resources of the network,
The virtual nodes used for data communication in the SAN for each end node that is the source and destination of the transfer frame transferred by the frame relay device, and for each frame relay device through which the transfer frame passes from the source to the destination While VSANID for specifying a network is set for each SAN protocol type for each tenant, at least one VLANID for specifying a virtual network used for LAN data communication is set for each tenant,
The storage means of the frame relay apparatus includes a policy level table indicating the corresponding policy level for each of the VSANID and the VLANID, and a policy content indicating utilization setting of the data network resource corresponding to the policy level. And a policy setting table shown in FIG.
The control unit of the frame relay device
The policy level which is a search result is acquired by searching the policy level table using the VSANID or the VLANID specified from the transfer frame received from the end node of the transmission source as a search key,
Data transfer characterized in that the received transfer frame is transferred to the frame relay device on a route toward the end node as a destination according to the policy content corresponding to the policy level acquired in the policy setting table. Method.

Images