CN105099915A - Business path establishing method and device - Google Patents

Abstract

The invention provides a method and equipment for establishing a service path, which relate to the field of communication, can realize flexible deployment of service processing equipment, only need to know the Internet protocol address of the service processing equipment during policy configuration, and improve the maintainability of the service chain. The method is: receiving the request message generated by the starting point device, the request message includes the IP addresses of all service processing devices in the service path, the pointer indicating the IP address and the flow classification information, according to the Internet protocol address pointed to by the pointer Protocol address, determine the destination address of the tunnel entry and the destination address of the tunnel exit of the virtual private network forwarding entry to be generated, and generate the virtual private network according to the destination address of the tunnel entry, the destination address of the tunnel exit and the flow classification information The table entry is forwarded, and the pointer is incremented by one, and then the request message is forwarded according to the IP address pointed to by the incremented pointer. The invention is used for automatically establishing service paths.

Description

A method and device for establishing a service path

technical field

The present invention relates to the communication field, in particular to a method and equipment for establishing a service path.

Background technique

With the development of network technology, software and hardware products have become more diversified and their performance has been continuously enhanced. Users can freely choose various network service processing devices for service processing according to service needs. While users have more choices, some problems have also been raised, such as how to conveniently form a network, add or delete service processing devices as needed, and flexibly arrange service traffic. Service-Chaining (English: Service-Chaining) is a network technology that flexibly connects several service processing devices into a service chain and guides related service traffic to flow through the service processing devices in the service chain in a predetermined order. Through Service-Chaining technology, various complex business service logics and models can be flexibly defined in various complex networking environments.

In the current networking, the service chain function is generally approximated by policy routing technology. For example, three service processing devices are hung on a switch: firewall, anti-virus gateway and application management and control gateway. Several of these three devices can be arranged and combined in an orderly manner to form multiple service chains. Here, firewall → anti-virus gateway Take this service chain as an example. When the traffic of a certain service flow passes through the switch, the switch needs to identify the service flow and guide it to the firewall → anti-virus gateway for service processing in sequence. It can be realized by configuring policy routing on the Internet, and redirecting the service flow conforming to the policy routing to the specified interface or the next-hop Internet Protocol (English: Internet Protocol, abbreviation: IP) address.

Manual configuration through traditional policy routing can also realize the service chain function, but there are obviously some problems and disadvantages, such as: complex policy configuration. Users need to know clearly which service processing devices are connected to the switch, what are the inbound and outbound interfaces connected to, what is the IP address of the interface connected to the service processing device, and which interface on the switch should the traffic of each service chain go to Business processing equipment, and then which interface to come back from and other issues. When the number of service processing devices on the service chain is small and the service flow is relatively simple, the networking strategy is relatively simple, and users can handle it through manual configuration. Once the number of service processing devices increases and service flows need to be subdivided, the complexity of networking strategies increases exponentially, and the user's manual configuration tasks are heavy. For another example, because the service chain function is implemented by the policy routing mechanism, in maintenance, only the connectivity between two interconnected devices can be checked, and the connectivity status of the entire service chain cannot be checked, which makes maintenance difficult.

Contents of the invention

The present invention provides a method and equipment for establishing a service path, which can realize flexible deployment of service processing equipment, and only need to know the Internet protocol address of the service processing equipment during policy configuration, thereby improving the maintainability of the service chain.

To achieve the above object, the present invention adopts the following technical solutions:

In the first aspect, a method for establishing a business path is provided, including:

receiving a request message generated by the starting point device, the request message including the Internet Protocol addresses of all service processing devices in the service path, pointers indicating the Internet Protocol addresses, and flow classification information;

According to the IP address pointed to by the pointer, determine the incoming tunnel destination address and the outgoing tunnel destination address of the virtual private network forwarding entry to be generated;

Generate the virtual private network forwarding entry according to the destination address of the tunnel entry, the destination address of the tunnel exit, and the flow classification information, and add one to the pointer, and then follow the IP address pointed to by the pointer after adding one. Forwarding the request message, so that when the request message arrives at the termination device, the termination device returns a response message indicating that the establishment of the service path is completed to the starting point device.

With reference to the first aspect, in the first possible implementation of the first aspect, the destination address of the tunnel entry and the destination of the tunnel exit of the virtual private network forwarding entry to be generated are determined according to the IP address pointed to by the pointer. Addresses include:

Judging whether the previous Internet Protocol address pointed to by the pointer exists, if it exists, then use the previous Internet Protocol address as the incoming tunnel destination address of the virtual private network forwarding table item to be generated, and the incoming tunnel destination address is forwarding The previous IP address of the request message; if it does not exist, then determine that the incoming tunnel destination address of the virtual private network forwarding entry to be generated is empty; and

Judging whether the last IP address pointed to by the pointer exists, if it exists, then use the latter IP address as the outgoing tunnel destination address of the virtual private network forwarding entry to be generated, and the outgoing tunnel destination address is forwarding The next IP address of the request message; if it does not exist, it is determined that the outbound tunnel destination address of the virtual private network forwarding entry to be generated is empty.

With reference to the first aspect or the first possible implementation of the first aspect, in the second possible implementation of the first aspect, the request message further includes status information and relative time information of the current service processing device;

The response message includes status information of all service processing devices, so that the starting point device obtains the status of all service processing devices and the establishment of the service path according to the status information.

In combination with the first aspect or the first or second possible implementation manner of the first aspect, in the third possible implementation manner of the first aspect, the method further includes:

When receiving a service message corresponding to the flow classification information, perform service processing on the service message, obtain the processed service message, obtain the VPN forwarding table item, and forward according to the VPN The published item forwards the processed service message.

In combination with the first aspect or any one of the first to third possible implementation manners of the first aspect, in a fourth possible implementation manner of the first aspect, the flow classification information includes a preset five-tuple Classified information;

Or, the flow classification information includes a classification control access list number.

In a second aspect, a device is provided, including:

A receiving unit, configured to receive a request message generated by the starting point device, the request message including the Internet Protocol addresses of all service processing devices on the service path, pointers indicating the Internet Protocol addresses, and flow classification information;

A determining unit, configured to determine the tunnel-entry destination address and the tunnel-out destination address of the virtual private network forwarding entry to be generated according to the IP address pointed to by the pointer;

a generating unit, configured to generate the virtual private network forwarding entry according to the inbound tunnel destination address, the outbound tunnel destination address, and the flow classification information;

a processing unit, configured to add one to the pointer;

A sending unit, configured to forward the request message according to the IP address pointed to by the pointer after adding 1, so that when the request message arrives at the terminal device, the terminal device returns a representation to the starting point device A response message indicating that the establishment of the service path is completed.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the determining unit is specifically configured to:

Judging whether the previous Internet Protocol address pointed to by the pointer exists, if it exists, then use the previous Internet Protocol address as the incoming tunnel destination address of the virtual private network forwarding table item to be generated, and the incoming tunnel destination address is forwarding The previous IP address of the request message; if it does not exist, then determine that the incoming tunnel destination address of the virtual private network forwarding entry to be generated is empty; and

Judging whether the last IP address pointed to by the pointer exists, if it exists, then use the latter IP address as the outgoing tunnel destination address of the virtual private network forwarding entry to be generated, and the outgoing tunnel destination address is forwarding The next IP address of the request message; if it does not exist, it is determined that the outgoing tunnel destination address of the virtual private network forwarding entry to be generated is empty.

With reference to the second aspect or the first possible implementation manner of the second aspect, in the second possible implementation manner of the second aspect, the request message further includes status information and relative time information of the current service processing device;

The response message includes status information of all service processing devices, so that the starting point device obtains the status of all service processing devices and the establishment of the service path according to the status information.

With reference to the second aspect or the first or second possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, the processing unit is further configured to, when receiving the corresponding stream When classifying the service message of information, perform business processing on the service message to obtain the processed service message; the sending unit is also used to obtain the forwarding entry of the virtual private network, according to the The forwarding entry forwards the processed service message.

In combination with the second aspect or any one of the first to third possible implementations of the second aspect, in a fourth possible implementation of the second aspect, the flow classification information includes a preset quintuple Classified information;

Or, the flow classification information includes a classification control access list number.

The present invention provides a method and device for establishing a service path. By receiving the request message generated by the starting point device, the request message includes the Internet protocol address of all service processing devices in the service path, pointers indicating the Internet protocol address, and flow classification information. , according to the IP address pointed to by the pointer, determine the destination address of the tunnel entry and the destination address of the tunnel exit of the virtual private network forwarding table item to be generated, and generate the virtual private network forwarding table according to the destination address of the tunnel entry, the destination address of the tunnel exit and the flow classification information item, and add one to the pointer, and then forward the request message according to the IP address pointed to by the pointer after adding one, so that when the request message reaches the terminal device, the terminal device returns to the starting point device to indicate that the service path is established The response message can realize the flexible deployment of service processing equipment, simplify the process of policy configuration, and improve the maintainability of the service chain.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

FIG. 1 is a schematic diagram of a system provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a method for establishing a service path provided by an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a device provided by an embodiment of the present invention;

Fig. 4 is a schematic structural diagram of another device provided by an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Service-Chaining network technology can flexibly define various complex business service logic and models in various complex networking environments. Generally speaking, Service-Chaining can include the following technical terms and concepts:

Service flow: A data flow containing packets with specific service characteristics (for example, packets matching a certain field) or packets matching certain business policies (such as a certain access IP, port, etc.).

Link point: refers to the business processing equipment on the business chain, and refers to the independent business processing equipment, such as firewall, anti-virus gateway, application management and control gateway, etc.

Forwarding path: refers to the actual path composed of all the devices that the packet passes through during the forwarding process from the source to the destination.

Service path: refers to the logical path composed of service processing devices (link points) that must pass through when the message is forwarded from the source to the destination.

As shown in FIG. 1 , it is a schematic diagram of a system provided by an embodiment of the present invention. The present invention mainly lies in the change of the internal processing flow and processing mode of the start point and the end point. In Figure 1, the starting point and the ending point are logical nodes. The starting point is generally undertaken by forwarding devices such as switches and routers, and the ending point is generally the last service processing device in a service chain. The solid line in Fig. 1 is a service flow, and the message forwarding path of server A accessed by user A; the dotted line is the forwarding path of the virtual private network (English: VirtualPrivateNetwork, abbreviation: VPN) path control message applied by Service-Chaining technology , by defining such a control message, and making the control message sequentially establish a VPN tunnel path between two adjacent service processing devices in the service chain, and at the same time generate a service flow redirection policy on the upstream service processing device of the tunnel for subsequent Real business matching and forwarding; the dotted line describes the service processing path that the service flow needs to pass through, that is, the Service-Chaining service chain path. The service chain in the embodiment of the present invention is as follows: starting point → service processing device 1 → service processing device 2→Service processing device 3 is described as an example.

The Service-Chaining mechanism realized by the present invention is to enable the forwarding path of the service flow to cover the service path through the established technical means, and to forward and process the service message according to the preset service path.

In addition, since the same service processing device may be used by multiple service chains, one service processing device may establish tunnels with multiple other service processing devices. In the embodiment of the present invention, multi-generic routing encapsulation (English: multi-GenericRoutingEncapsulation, Abbreviation: mGRE) technology, the mGRE type tunnel (English: Tunnel) interface is generated in advance on the starting point and each service processing device. This interface only needs to configure the source address of the service processing device, and does not need to specify the destination address to realize a Multiple GRE tunnels exist on the mGRE tunnel interface, corresponding to multiple GRE peers.

For the control message mentioned in the above description, the embodiment of the present invention provides a special message type, which is called a VPN path control message here, and will be referred to as a control message hereinafter. There are many ways to realize the encapsulation of the control message, and the embodiment of the present invention provides a typical encapsulation mode for Layer 3 VPN. In order to improve the penetration on forwarding devices such as switching and routing, the embodiment of the present invention adopts User Datagram Protocol (English: UserDatagramProtocol, abbreviation: UDP) protocol encapsulation, and the source and destination port numbers are all set to 65001, and the intermediate device can The control packet can be determined through the UDP protocol and port number information. Among them, the control-related parameters can be placed in the Payload load part of UDP.

Specifically, as shown in Table 1, the structure of the control message may include Type (type), Length (length), SequenceNo (serial number), path control information, and so on. Wherein, Type is the type of the control message, including a request message (a request to generate a message or a request to delete a message) and a response message. Length refers to the length of the entire VPNPathControlData (path control data). SequenceNo refers to the sequence number of the current control message, and each request and response message can have the same sequence number. Path control information is based on different types of control packets, and the format of this field is different.

Table 1 Control message structure

Wherein, IPHeader contains source address and destination address, in order to indicate the source and purpose of this control message; Text type; VPNPathControlData (VPN path control data) is used to include the above-mentioned fields such as Type, Length, and SequenceNo.

On the basis of the structure of the control message shown in Table 1 provided by the present invention, as shown in Table 2, the structure of the request message can include: define the field type (English: TrafficClassifierType, abbreviation: TCType) of flow classification information , which can be the control access list (English: AccessControlList, abbreviation: ACL) type, or the quintuple information type; the traffic classification information (English: TrafficClassifier), can be the ACL number, or the quintuple traffic classification information; Define the field type (English: NodeType) of the VPN node, for example, it can be the IP address information of the node; the pointer (English: Pointer) refers to the node that is currently requesting to generate a VPN tunnel when there are multiple VPN node information information; VPN node information, which is used to fill in the address information of the VPN node; the field type (English: StatisticsType) that defines the state information, which can be the type of statistical information of the running status of each VPN node, or it can be the The time information type, etc.; StatisticsLength (defining the field length of the status information); the status information can be the running status statistics information of each VPN node, or the time information of reaching each node, etc.

Table 2 Request message structure

On the basis of the structure of the control message as shown in Table 1 provided by the present invention, as shown in Table 3, the structure of the response message can include: StatisticsType, which defines the field type of status information, can be each VPN node The type of running status statistics information can also be the type of time information arriving at each node; StatisticsLength defines the field length of the status information; status information defines the status information, which can be the running status statistics information of each VPN node, or It can be the time information of arriving at each node, etc.

Table 3 Structure of response message

Based on the above-mentioned newly defined control message, before the method is executed in the present invention, an initial configuration is first required, and the initial configuration includes:

A. Select a starting point device in the network.

Specifically, the starting point device is selected by the user, and the starting point device is a device that generates a control message and sends the control message to the next service processing device for the first time. Usually, the starting point device here can be The switch is, for example, the switch 1 shown in FIG. 1 . The request message will start from the starting point device, pass through each business processing device in the service chain in turn, and take the last business processing device as the end point. When each device sends a request message, it needs to modify its source and destination IP, and The response message is sent directly from the termination point to the origination point. Here, the source and destination port numbers of the message may both be 65001. The request message needs to be identified and processed on each service processing device. Every time a request message is sent, SequenceNo will be incremented. During the same control request process, the SequenceNo of the request and response packets is the same.

B. Define a Service-Chaining service chain VPN path request message on the starting point device.

Specifically, the user needs to formulate two main types of information. One is the service processing equipment information of the service chain, and the other is the service flow information.

Exemplarily, taking the control request to generate a message as an example, for the service processing device information of the specified service chain, as shown in the system networking diagram in Figure 1, the service processing device is equivalent to the service processing device, then the service chain A is It can be: business processing device 1 → business processing device 2 → business processing device 3, where the information of three business processing devices: business processing device 1, business processing device 2 and business processing device 3, since the starting point device (switch) as a The drainage point needs to join the business chain by default, so the business chain A actually becomes the business chain A': starting point device → business processing device 1 → business processing device 2 → business processing device 3, and the request message A will be sent from the starting point To the salesman device 1, then to the service processing device 2, and finally to the service processing device 3, therefore, the user needs to explicitly specify the IP address information of the service processing device of the service chain. In this way, when the starting point device generates a request message, it will fill in the IP addresses of each service processing device in the service chain A' in the VPN node information field of the request message A in turn, and initially set the Pointer pointer to 1, and the message The source and destination IP are set as the starting point IP, indicating that the current request packet is initially generated.

Define service flow information, that is, define which subsequent service flows will be forwarded using the VPN path generated this time. There are many ways to define the business flow here, and the typical ones are as follows:

a) The user may carry specific five-tuple traffic classification information in the TrafficClassifier traffic classification information field of the request message in advance. The five-tuple flow classification information here may be a set of five quantities consisting of source IP address, source port, destination IP address, destination port, and transport layer protocol number.

b) The traffic classification ACL number may be carried in the request message, and the specific rules and policies of the ACL are requested from the policy server when the VPN tunnel is successfully generated.

c) The request message carries the flow classification ACL number, and the specific rules and policies are pre-generated on each service processing device.

The embodiment of the present invention is described in manner c. For example, the specific implementation of typical policy configuration on each service processing device can be as follows:

1) First, pre-define the control access list number ACL as 9000 on the starting point device, service processing device 1, service processing device 2 and service processing device 3:

acl9000//Defines the traffic from the source address segment 172.168.0.0 to the destination address segment 10.1.0.0

rulepermitipsource172.168.0.0.0.0.255.255destination10.1.0.0.0.0.255.255

2) Then configure the VPN path generation request on the starting point device: generate the VPN path described by the service chain A' (starting point device → business processing device 1 → business processing device 2 → business processing device 3), and will conform to the ACL9000 defined The service flow is guided to the VPN path for forwarding. The specific command line strategy is as follows:

service-chainingVPN-pathcreateacl9000vpn-nodeipIP start point IP1IP2IP3

Wherein, IP1, IP2 and IP3 are IP addresses of service processing devices 1, 2 and 3 respectively.

In this way, after the user selects the starting point device and defines the Service-Chaining service VPN path request message on the starting point device, when the starting point device obtains the start operation command, it will generate the request message according to the above definition , forward the request message to the corresponding service processing device according to the destination IP address, and the intermediate device only performs transparent transmission. The intermediate devices here can be, for example, the switch 2 and the switch 3 shown in FIG. 1 . As shown in Figure 2, the specific processing steps are as follows:

101. The service processing device receives a request message generated by the starting point device, where the request message includes Internet Protocol addresses of all service processing devices on a service path, pointers indicating Internet Protocol addresses, and flow classification information.

The service processing device here may be one of the service processing device 1 , the service processing device 2 or the service processing device 3 shown in FIG. 1 . The format of the request message is shown in Table 2, which carries the IP addresses of all service processing devices of the service path preset by the user, Pointer pointers, and flow classification information that needs to pass through the service path.

102. The service processing device determines an in-tunnel destination address and an out-tunnel destination address of the virtual private network forwarding entry to be generated according to the IP address pointed to by the pointer.

Specifically, when the service processing device receives the request message, it first judges whether the previous IP address pointed to by the pointer of the request message exists, and if it exists, the previous IP address is used as the VPN transfer address to be generated. The entry tunnel destination address of the entry, that is, the entry tunnel destination address is the last IP address forwarding the request message, if it does not exist, the current service processing device determines the entry tunnel destination of the VPN forwarding entry to be generated The address is empty, that is, the current service processing device is the starting point device. Then, judge whether the last IP address pointed to by the pointer of the request message exists, if there is, then use the latter IP address as the outgoing tunnel destination address of the VPN forwarding entry, and the outgoing tunnel destination address is to forward the request If the next IP address of the message does not exist, it is determined that the outbound tunnel destination address of the VPN forwarding entry to be generated is empty, that is, the current service processing device is the termination device for forwarding the request message.

103. The service processing device generates the virtual private network forwarding entry according to the destination address of the inbound tunnel, the destination address of the outbound tunnel, and the flow classification information, and adds one to the pointer, and then points to the pointer according to the added one. The IP address forwards the request packet.

Specifically, after determining the tunnel entry destination address and the tunnel exit destination address of the VPN forwarding entry in step 103, the tunnel entry destination address and the tunnel exit destination address are combined with the flow classification information in the request message The association generates the virtual forwarding entries, and saves the forwarding entries of each device locally. For example, for the starting point device, the content of the forwarding table entry of the starting point device is: flow classification: ACL9000; the incoming tunnel is not limited; the incoming tunnel destination address is not limited; the outgoing tunnel can be Tunnel1.1, for example; Tunnel destination address: IP1, that is to say, the starting point device can redirect the traffic conforming to ACL9000 to the tunnel interface Tunnel1.1. By analogy in this way, the forwarding entries of the starting point device and each service processing device can be summarized as shown in Table 4.

Table 4VPN forwarding entry

It should be noted that the ingress tunnel and the egress tunnel in the forwarding entry are two logical tunnel ports. In fact, there is only one tunnel port in each device, and the tunnels of each device are independent tunnels for receiving and sending packets. arts.

During the forwarding process of the request message, if the status of the service processing device needs to be echoed, the request message can also be filled with the status information of the current service processing device, relative time information, and the like. The status information here may include, for example, issues such as connectivity, delay, and utilization rate of intermediate devices.

104. When the request message arrives at the termination device, the termination device returns a response message indicating that the establishment of the service path is completed to the start point device.

Specifically, when the next IP address pointed to by the pointer in the received request message does not exist, the service processing device learns that its own device is a terminal device, terminates the request message, and transfers the The status information field in the request message is stripped out, filled into the response message indicating that the service path is established, and then directly sends the response message to the starting point device, and the starting point device receives the response message After receiving the message, the status of each link node and the generation of the service chain in the VPN generation process can be displayed. Of course, the state information here is the superposition of the state information of each service processing device. Thus, the service path is automatically established successfully.

When the service message corresponding to the flow classification information arrives at the starting point device, the starting point device obtains the VPN forwarding entry of the starting point device in Table 4, so that the service message can reach each service processing through the VPN tunnel in turn equipment to complete all business processing.

When the service processing device receives the service message corresponding to the flow classification information, the service processing device performs service processing on the service message, obtains the processed service message, and obtains the virtual private network forwarding entry , forwarding the processed service packet according to the virtual private network forwarding entry.

The embodiment of the present invention can implement a service path method for automatically establishing a service chain, through the newly formulated VPN path control message, for the flow point and each service processing device on the service chain, the flow point→service processing device 1 is sequentially established, Business processing device 1 → business processing device 2, ..., business processing device N-1 → business processing device N's two-two VPN tunnel path, establish a traffic diversion strategy at the upstream node of each tunnel, and direct the specified business flow to the VPN tunnel It is forwarded to the downstream node, so as to realize the function of Service-Chaining business chain. This mechanism automatically establishes a VPN service path through control packets, so it can realize flexible deployment of service processing equipment, does not limit the connection to a diversion point device, and does not require users to perform cumbersome policy configuration. In addition, this mechanism can choose to carry the relevant status information of the service link point that generated the control message in the response control message, so that it can display a series of information such as connectivity and delay on the current service path to the user, greatly simplifying the maintenance work.

An embodiment of the present invention provides a device 01, as shown in FIG. 3 , including:

The receiving unit 011 is configured to receive the request message generated by the starting point device, the request message includes the Internet Protocol addresses of all service processing devices in the service path, pointers indicating the Internet Protocol addresses, and flow classification information.

The determining unit 012 is configured to determine the tunnel-entry destination address and the tunnel-out destination address of the virtual private network forwarding entry to be generated according to the IP address pointed to by the pointer.

A generating unit 013, configured to generate the virtual private network forwarding entry according to the inbound tunnel destination address, the outbound tunnel destination address, and flow classification information.

The processing unit 014 is configured to add one to the pointer.

The sending unit 015 is configured to forward the request message according to the IP address pointed to by the added pointer, so that when the request message reaches the terminal device, the terminal device returns to the starting point device A response message indicating that the establishment of the service path is completed.

Optionally, the determining unit 012 may be specifically used for:

Judging whether the previous Internet Protocol address pointed to by the pointer exists, if it exists, then use the previous Internet Protocol address as the incoming tunnel destination address of the virtual private network forwarding table item to be generated, and the incoming tunnel destination address is forwarding The last IP address of the request message; if it does not exist, it is determined that the incoming tunnel destination address of the virtual private network forwarding entry to be generated is empty;

Judging whether the last IP address pointed to by the pointer exists, if it exists, then use the latter IP address as the outgoing tunnel destination address of the virtual private network forwarding entry to be generated, and the outgoing tunnel destination address is forwarding The next IP address of the request message; if it does not exist, it is determined that the outgoing tunnel destination address of the virtual private network forwarding entry to be generated is empty.

Optionally, the request message may also include status information and relative time information of the current service processing device;

The response message includes status information of all service processing devices, so that the starting point device obtains the status of all service processing devices and the establishment of the service path according to the status information.

Optionally, the processing unit 014 is further configured to, when receiving a service message corresponding to the flow classification information, perform service processing on the service message to obtain a processed service message; the sending unit 015 is also used to obtain the virtual private network forwarding entry, and forward the processed service message according to the virtual private network forwarding entry.

Optionally, the flow classification information may include preset five-tuple classification information;

Alternatively, the flow classification information may include a classification control access list number.

An embodiment of the present invention provides a device. By receiving the request message generated by the starting point device, the request message includes the Internet protocol address of all service processing devices in the service path, pointers indicating the Internet protocol address, and flow classification information. The IP address of the Internet protocol, determine the destination address of the tunnel entry and the destination address of the tunnel exit of the virtual private network forwarding table entry to be generated, generate the virtual private network forwarding table entry according to the destination address of the tunnel entry, the destination address of the tunnel exit and the flow classification information, and send Add one to the pointer, and then forward the request message according to the IP address pointed to by the pointer after adding one, so that when the request message reaches the terminal device, the terminal device returns a response message indicating that the service path is established to the starting point device , which can realize flexible deployment of service processing equipment, simplify the process of policy configuration, and improve the maintainability of service chains.

An embodiment of the present invention provides a device 02. As shown in FIG. 4, the device 02 includes: a bus 021, a processor 022, a transmitter 023, a receiver 024, and a memory 025, wherein the memory 025 is used to store instructions and data . The transmitter 023 and the receiver are used for communicating with external devices. The receiver 024 is configured to receive a request message generated by the starting point device, and the request message includes IP addresses of all service processing devices in the service path, pointers indicating Internet protocol addresses, and flow classification information. The processor 022 is used to call this instruction to realize: according to the IP address pointed to by the pointer, determine the tunnel entry destination address and the tunnel destination address of the virtual private network forwarding entry to be generated; according to the tunnel entry destination address and The outbound tunnel destination address and flow classification information determine the virtual private network forwarding entry, and add one to the pointer. The transmitter 023 is configured to forward the request message according to the IP address pointed to by the pointer after adding 1, so that when the request message arrives at the terminal device, the terminal device returns a representation to the starting point device A response message indicating that the service path is established.

In the embodiment of the present invention, optionally, according to the IP address pointed to by the pointer, determining the tunnel entry destination address and the tunnel exit destination address of the virtual private network forwarding entry to be generated is specifically used for:

Judging whether the previous Internet Protocol address pointed to by the pointer exists, if it exists, then use the previous Internet Protocol address as the incoming tunnel destination address of the virtual private network forwarding table item to be generated, and the incoming tunnel destination address is forwarding The previous IP address of the request message; if it does not exist, then determine that the incoming tunnel destination address of the virtual private network forwarding entry to be generated is empty; and

Judging whether the last IP address pointed to by the pointer exists, if it exists, then use the latter IP address as the outgoing tunnel destination address of the virtual private network forwarding entry to be generated, and the outgoing tunnel destination address is forwarding The next IP address of the request message; if it does not exist, it is determined that the outgoing tunnel destination address of the virtual private network forwarding entry to be generated is empty.

In this embodiment of the present invention, optionally, the request message further includes status information and relative time information of the current service processing device;

The response message includes status information of all service processing devices, so that the starting point device obtains the status of all service processing devices and establishment of service paths according to the status information.

In the embodiment of the present invention, the processor 022 is used to call the instruction to realize: when receiving the service message corresponding to the flow classification information, perform service processing on the service message to obtain the processed service message ;

The transmitter 023 is further configured to acquire the VPN forwarding entry, and forward the processed service message according to the VPN forwarding entry.

In this embodiment of the present invention, optionally, the flow classification information includes preset five-tuple classification information;

Alternatively, the flow classification information includes a classification control access list number.

An embodiment of the present invention provides a device. By receiving the request message generated by the starting point device, the request message includes the Internet protocol address of all service processing devices in the service path, pointers indicating the Internet protocol address, and flow classification information. The IP address of the Internet protocol, determine the destination address of the incoming tunnel and the outgoing tunnel destination address of the virtual private network forwarding table entry to be generated, determine the virtual private network forwarding table entry according to the incoming tunnel destination address, the outgoing tunnel destination address and the flow classification information, and Increment the pointer by one, and then forward the request message according to the IP address pointed to by the pointer after adding one, so that when the request message arrives at the terminal device, the terminal device returns a response message indicating that the service path is established to the starting point device This can realize flexible deployment of service processing equipment, simplify the process of policy configuration, and improve the maintainability of service chains.

In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

In addition, in the devices and systems in various embodiments of the present invention, each functional unit may be integrated into one processing unit, each unit may be physically included separately, or two or more units may be integrated into one unit. Moreover, each of the above-mentioned units can be implemented in the form of hardware, or can be implemented in the form of hardware plus software functional units.

All or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, and when the program is executed, the steps including the above-mentioned method embodiments are executed; The aforementioned storage media include: U disk, mobile hard disk, read-only memory (English: ReadOnlyMemory, abbreviated: ROM), random access memory (English: RandomAccessMemory, abbreviated: RAM), magnetic disk or optical disc, etc. The medium of the code.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (10)

1. set up a method for service path, it is characterized in that, comprising:

Receive the request message that starting point equipment generates, described request message comprises the internet protocol address of all service processing equipments of described service path, the pointer indicating described internet protocol address and traffic classification information;

According to the internet protocol address of described pointed, determine entering tunnel destination address and going out tunnel destination address of forwarding table term of virtual private network to be generated;

According to described enter tunnel destination address and described go out tunnel destination address and described traffic classification information generate described forwarding table term of virtual private network, and described pointer is added one, described request message is forwarded again according to the internet protocol address adding the pointed after, so that after described request message arrives destination node equipment, described destination node equipment returns the back message representing that described service path has been set up to described starting point equipment.

2. method according to claim 1, is characterized in that, the described internet protocol address according to described pointed, determines entering tunnel destination address and going out tunnel destination address and comprise of forwarding table term of virtual private network to be generated:

Judge whether the previous internet protocol address of described pointed exists, if exist, then described previous internet protocol address is entered tunnel destination address as forwarding table term of virtual private network to be generated, described in enter tunnel destination address be the upper internet protocol address forwarding described request message; If do not exist, then that determines forwarding table term of virtual private network to be generated enters tunnel destination address for empty; And

Judge whether a rear internet protocol address of described pointed exists, if exist, then a described rear internet protocol address is gone out tunnel destination address as forwarding table term of virtual private network to be generated, described in go out tunnel destination address be the next internet protocol address forwarding described request message; If do not exist, then that determines forwarding table term of virtual private network to be generated goes out tunnel destination address for empty.

3. method according to claim 1 and 2, is characterized in that,

Described request message also comprises state information and the relative time information of current business treatment facility;

Described back message comprises the state information of described all service processing equipments, sets up situation with what make the state of described starting point equipment all service processing equipments according to described state information acquisition and described service path.

4. the method according to any one of claims 1 to 3, is characterized in that, described method also comprises:

When receiving the service message of corresponding described traffic classification information, Business Processing is carried out to described service message, obtain the service message after processing, obtain described forwarding table term of virtual private network, forward the service message after described process according to described forwarding table term of virtual private network.

5. the method according to any one of Claims 1-4, is characterized in that, described traffic classification information comprises default five-tuple classified information;

Or described traffic classification information comprises the list number of classification access control.

6. an equipment, is characterized in that, comprising:

Receiving element, for receiving the request message that starting point equipment generates, described request message comprises the internet protocol address of all service processing equipments of service path, the pointer indicating described internet protocol address and traffic classification information;

Determining unit, for the internet protocol address according to described pointed, determines entering tunnel destination address and going out tunnel destination address of forwarding table term of virtual private network to be generated;

Generation unit, for enter described in basis tunnel destination address and described go out tunnel destination address and described traffic classification information generate described forwarding table term of virtual private network;

Processing unit, for adding one by described pointer;

Transmitting element, for forwarding described request message according to the internet protocol address adding the pointed after, so that when described request message arrives destination node equipment, described destination node equipment returns the back message representing that described service path has been set up to described starting point equipment.

7. equipment according to claim 6, is characterized in that, described determining unit specifically for:

Judge whether the previous internet protocol address of described pointed exists, if exist, then described previous internet protocol address is entered tunnel destination address as forwarding table term of virtual private network to be generated, described in enter tunnel destination address be the upper internet protocol address forwarding described request message; If do not exist, then that determines forwarding table term of virtual private network to be generated enters tunnel destination address for empty; And

Judge whether a rear internet protocol address of described pointed exists, if exist, then a described rear internet protocol address is gone out tunnel destination address as forwarding table term of virtual private network to be generated, described in go out tunnel destination address be the next internet protocol address forwarding described request message; If do not exist, then that determines forwarding table term of virtual private network to be generated goes out tunnel destination address for empty.

8. the equipment according to claim 6 or 7, is characterized in that,

Described request message also comprises state information and the relative time information of current business treatment facility;

Described back message comprises the state information of described all service processing equipments, sets up situation with what make the state of described starting point equipment all service processing equipments according to described state information acquisition and described service path.

9. the equipment according to any one of claim 6 to 8, is characterized in that,

Described processing unit also for, when receiving the service message of corresponding described traffic classification information, Business Processing is carried out to described service message, obtain process after service message;

Described transmitting element also for, obtain described forwarding table term of virtual private network, forward the service message after described process according to described forwarding table term of virtual private network.

10. the equipment according to any one of claim 6 to 9, is characterized in that, described traffic classification information comprises default five-tuple classified information;

Or described traffic classification information comprises the list number of classification access control.