CN117176673A - Method, system, device and computer equipment for realizing peer-to-peer connection between subnets - Google Patents

Abstract

The disclosure relates to a method, a system, a device and computer equipment for realizing peer-to-peer connection between subnetworks, comprising: acquiring request information and network configuration information issued by a user; obtaining a first subnet to be connected with the local virtual private cloud, a first network to which the first subnet belongs, a second subnet to which the opposite virtual private cloud is to be connected, a second network to which the second subnet belongs, a local virtual private cloud virtual router and an opposite virtual private cloud virtual router according to the request information and the network configuration information; determining a first virtual router corresponding to the local virtual private cloud virtual router in the first switch according to the router mapping relation, and determining a second virtual router corresponding to the opposite virtual private cloud virtual router in the first switch according to the router mapping relation; transmitting the data packet sent by the first subnet to a first virtual router through a first network; receiving a data packet returned from the second virtual router; the data packet is sent to a second subnetwork of the second network.

Description

Method, system, device and computer equipment for realizing peer-to-peer connection between subnets

Technical field

The present disclosure relates to the field of computer network technology, and specifically to methods, systems, devices, and computer equipment for realizing peer-to-peer connections between subnets.

Background technique

With the development of cloud computing technology, more and more enterprises are migrating their business to the cloud and using switches and related equipment to share cloud network resources. The development of cloud computing enables enterprises to manage and utilize resources more efficiently, while reducing management and maintenance costs. Due to the needs of enterprises for network security and network isolation, VPC (Virtual Private Cloud) technology has been developed. Networks within VPCs are interconnected and networks between VPCs are isolated. In order to ensure the network isolation between VPCs, designated subnets between some VPCs can communicate with each other, and peering connection technology came into being.

Peering connection is a cloud computing network solution based on physical network equipment. It can provide higher security and stability. It constructs a network tunnel between two isolated VPCs and allows partial subnets between VPCs. Communicate with each other and take into account the needs of isolation and interoperability. However, in traditional peer-to-peer connection solutions, users usually need to perform tedious configuration and management on hardware network devices. The operations are complex and require a large investment in human resources, making the enterprise's labor costs high.

Contents of the invention

In view of this, the present disclosure provides a method, system, device, and computer device for implementing peer-to-peer connections between subnetworks to solve the problem that in traditional peer-to-peer connection solutions, users usually need to perform cumbersome configuration and management on hardware network devices. , the operation is complex and requires the investment of more human resources.

In a first aspect, the present disclosure provides a method for implementing peer-to-peer connections between subnets. The method is applied to a cloud platform. The method includes:

Obtain the request information and network configuration information issued by the user;

According to the request information and network configuration information, the first subnet to which the local virtual private cloud is to be connected, the first network to which the first subnet belongs, and the second subnet to which the peer virtual private cloud is to be connected, and the second subnet to which the second subnet belongs are obtained. The network as well as the local virtual private cloud virtual router and the opposite virtual private cloud virtual router, where the first subnet and the second subnet are network objects that implement peer-to-peer connections and the network addresses of the first subnet and the second subnet do not overlap;

Determine the first virtual router in the first switch corresponding to the local virtual private cloud virtual router according to the router mapping relationship, and determine the second virtual router in the first switch corresponding to the opposite end virtual private cloud virtual router according to the router mapping relationship, Among them, the router mapping relationship stores the corresponding relationship between each virtual router in each switch and the local virtual private cloud virtual router or the opposite end virtual private cloud virtual router;

Send the data packet sent from the first subnet to the first virtual router through the first network;

Receive the data packet returned from the second virtual router;

Send the packet to the second subnet of the second network.

In the embodiment of the present disclosure, the leaf-spine architecture is used to obtain the first switch that needs to be relied upon to achieve subnet peer-to-peer connection between the local virtual private cloud and the opposite virtual private cloud of the cloud platform, and determine the first switch based on the router mapping relationship. The first virtual router in the switch corresponds to the local virtual private cloud virtual router, and the second virtual router in the first switch corresponds to the opposite virtual private cloud virtual router, thereby completing the first virtual private cloud to be connected. The data packet sent by the subnet is transmitted to the first virtual router of the first switch, and then the data packet returned by the second virtual router of the first switch is received and sent to the second subnet of the second network, and then It can not only realize intercommunication between different VPCs, but also control the specific interoperable subnets in a fine-grained manner, which not only meets the security requirements of network isolation between VPCs, but also meets the requirements of mutual communication between designated subnets between VPCs, and thus It solves the problem that in traditional peer-to-peer connection solutions, users usually need to perform cumbersome configuration and management on hardware network devices, which wastes human resources.

In an optional implementation, the first subnet to which the local virtual private cloud is to be connected, the first network to which the first subnet belongs, and the second network to which the opposite end's virtual private cloud is to be connected are obtained according to the request information and the network configuration information. The subnet, the second network to which the second subnet belongs, the local virtual private cloud virtual router, and the peer virtual private cloud virtual router include:

Determine the first subnet to which the local virtual private cloud is to be connected and the second subnet to which the opposite end's virtual private cloud is to be connected based on the request information;

Determine the local virtual private cloud virtual router, the opposite virtual private cloud virtual router, the first network, and the second network according to the network configuration information.

In an optional implementation, there is at least one first subnet and at least one second subnet.

In a second aspect, embodiments of the present disclosure provide a method for implementing peer-to-peer connections between subnetworks. The method is applied to the first switch. The method includes:

The first virtual router receives a data packet sent from the first network of the local virtual private cloud. There is a mapping relationship between the first virtual router of the first switch and the local virtual private cloud virtual router. The data packet is the local virtual private cloud. Data sent by the first subnet to be connected in the first network of the cloud;

Send the data packet to the third virtual router in the second switch, where there is a mapping relationship between the first virtual router and the third virtual router;

The second virtual router receives the data packet returned from the fourth virtual router in the second switch, where there is a mapping relationship between the second virtual router and the fourth virtual router;

The second virtual router sends the data packet to the peer virtual private cloud.

In the embodiment of the present disclosure, direct communication between the cloud platform and the physical switch reduces the cloud platform's dependence on third-party SDN and improves the cloud platform's network capabilities and product competitiveness.

In a third aspect, embodiments of the present disclosure provide a method for implementing peer-to-peer connections between subnets. The method is applied to the second switch. The method includes:

The third virtual router receives the data packet forwarded by the first virtual router in the first switch. There is a mapping relationship between the third virtual router and the first virtual router, and the data packet is to be connected in the first network of the local virtual private cloud. Data sent by the first subnet;

Send the data packet to the firewall through the third virtual router;

Receive the firewall's verification command and the returned data packet;

The data packet is sent to the second virtual router of the first switch through the fourth virtual router, where there is a mapping relationship between the second virtual router and the fourth virtual router.

In the embodiments of the present disclosure, implementation based on hardware switches and firewalls can provide more reliable and efficient network transmission capabilities compared to pure software implementation.

In the fourth aspect, embodiments of the present disclosure provide a method for implementing peer-to-peer connections between subnets. The method is applied to firewalls. The method includes:

Receive a data packet sent by the third virtual router in the second switch, where the data packet is data sent by the first subnet to be connected in the first network of the local virtual private cloud;

Get the source address and destination address of the data packet;

Match the preset rules according to the source address and the target address to obtain the matching result, where the preset rules are used to characterize the original source address and the original target address;

Issue verification-passing instructions and data packets according to the matching results, and send the data packets to the fourth virtual router of the second switch.

In the embodiment of the present disclosure, a firewall is used to verify whether the data packet meets the preset rules, and the matching result is used as a condition for forwarding the data packet, which improves the security of mutual communication between designated networks between VPCs.

In the fifth aspect, embodiments of the present disclosure provide a peer-to-peer connection system between subnets. The system includes a cloud platform, a first switch, a second switch, and a firewall;

The cloud platform obtains the request information and network configuration information issued by the user;

The cloud platform obtains the first subnet to which the local virtual private cloud is to be connected and the first network to which the first subnet belongs and the second subnet to which the peer virtual private cloud is to be connected and the second subnet to which it belongs based on the request information and network configuration information. The second network, as well as the local virtual private cloud virtual router and the opposite virtual private cloud virtual router, where the first subnet and the second subnet are network objects that implement peer-to-peer connections, and the first subnet and the second subnet are Network addresses do not overlap;

The cloud platform determines the first virtual router in the first switch corresponding to the local virtual private cloud virtual router based on the router mapping relationship, and determines the second virtual router in the first switch corresponding to the opposite virtual private cloud virtual router based on the router mapping relationship. Router, wherein the router mapping relationship stores the corresponding relationship between each virtual router in each switch and the local virtual private cloud virtual router or the opposite end virtual private cloud virtual router;

The cloud platform sends the data packet sent by the first subnet to which the local virtual private cloud is to be connected to the first virtual router through the first network;

After receiving the data packet, the first virtual router of the first switch sends the data packet to the third virtual router of the second switch, where there is a mapping relationship between the third virtual router and the first virtual router;

After receiving the data packet, the third virtual router sends the data packet to the firewall through the third virtual router;

After receiving the data packet, the firewall obtains the source address and destination address of the data packet;

The firewall matches the preset rules according to the source address and the destination address to obtain the matching result, where the preset rules are used to characterize the original source address and the original destination address;

The firewall issues verification instructions and data packets based on the matching results, and sends the data packets to the fourth virtual router of the second switch;

After receiving the data packet, the fourth virtual router sends the data packet to the second virtual router of the first switch through the fourth virtual router, where there is a mapping relationship between the second virtual router and the fourth virtual router;

After receiving the data packet, the second virtual router sends the data packet to the opposite virtual private cloud;

After receiving the data packet, the peer virtual private cloud virtual router of the cloud platform sends the data packet to the second subnet of the second network.

In a sixth aspect, embodiments of the present disclosure provide a device for implementing peer-to-peer connections between subnets. The device is a cloud platform, and the device includes:

The first acquisition module is used to acquire the request information and network configuration information issued by the user;

The first obtaining module is used to obtain the first subnet to which the local virtual private cloud is to be connected, the first network to which the first subnet belongs, and the second subnet to which the opposite end's virtual private cloud is to be connected based on the request information and the network configuration information. The second network to which the second subnet belongs, as well as the local virtual private cloud virtual router and the peer virtual private cloud virtual router, where the first subnet and the second subnet are network objects that implement peer-to-peer connections, and the first subnet and The network addresses of the second subnet do not overlap;

Determining module, configured to determine the first virtual router in the first switch corresponding to the local virtual private cloud virtual router according to the router mapping relationship, and determine the first virtual router in the first switch corresponding to the opposite end virtual private cloud virtual router according to the router mapping relationship. The second virtual router, wherein the router mapping relationship stores the corresponding relationship between each virtual router in each switch and the local virtual private cloud virtual router or the opposite virtual private cloud virtual router;

The first sending module is used to send data packets sent by the first subnet to the first virtual router through the first network;

The first receiving module is used to receive data packets returned from the second virtual router;

The second sending module is used to send the data packet to the second subnet of the second network.

In a seventh aspect, embodiments of the present disclosure provide a device for implementing peer-to-peer connections between subnets. The device is a first switch, and the device includes:

The second receiving module is used for the first virtual router to receive data packets sent from the first network of the local virtual private cloud, where there is a mapping relationship between the first virtual router of the first switch and the local virtual private cloud virtual router, The data packet is data sent by the first subnet to be connected in the first network of the local virtual private cloud;

The third sending module is used to send the data packet to the third virtual router in the second switch, where there is a mapping relationship between the first virtual router and the third virtual router;

The third receiving module is configured for the second virtual router to receive the data packet returned from the fourth virtual router in the second switch, where there is a mapping relationship between the second virtual router and the fourth virtual router;

The fourth sending module is used for the second virtual router to send the data packet to the opposite end virtual private cloud.

In an eighth aspect, embodiments of the present disclosure provide a device for implementing peer-to-peer connections between subnets. The device is a second switch, and the device includes:

The fourth receiving module is used for the third virtual router to receive the data packet forwarded by the first virtual router in the first switch, where there is a mapping relationship between the third virtual router and the first virtual router, and the data packet is the local virtual private cloud. Data sent from the first subnet to be connected in the first network;

The fifth sending module is used to send the data packet to the firewall through the third virtual router;

The fifth receiving module is used to receive the firewall's verification passing instructions and the returned data packets;

The sixth sending module is configured to send the data packet to the second virtual router of the first switch through the fourth virtual router, where there is a mapping relationship between the second virtual router and the fourth virtual router.

In a ninth aspect, embodiments of the present disclosure provide a device for implementing peer-to-peer connections between subnets. The device is a firewall, and the device includes:

The sixth receiving module is configured to receive data packets sent by the third virtual router in the second switch, where the data packets are data sent by the first subnet to be connected in the first network of the local virtual private cloud;

The second acquisition module is used to obtain the source address and destination address of the data packet;

The second obtaining module is used to match the preset rules according to the source address and the target address to obtain the matching result, where the preset rules are used to characterize the original source address and the original target address;

The seventh sending module is configured to issue verification passing instructions and data packets according to the matching results, and send the data packets to the fourth virtual router of the second switch.

In a tenth aspect, the present disclosure provides a computer device, including: a memory and a processor. The memory and the processor are communicatively connected to each other. Computer instructions are stored in the memory. The processor executes the computer instructions to execute the first aspect. Or a method for implementing peer-to-peer connections between subnets in any of its corresponding embodiments.

In an eleventh aspect, the present disclosure provides a computer-readable storage medium. Computer instructions are stored on the computer-readable storage medium. The computer instructions are used to cause a computer to execute the sub-steps of the above-mentioned first aspect or any of its corresponding implementations. A method to implement peer-to-peer connections between networks.

Description of drawings

In order to more clearly explain the specific embodiments of the present disclosure or the technical solutions in the prior art, the drawings that need to be used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description The drawings illustrate some embodiments of the present disclosure. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting creative efforts.

Figure 1 is a schematic diagram of the interconnection of various networks within the VPC;

Figure 2 is a schematic flowchart of a method for implementing peer-to-peer connections between subnets according to an embodiment of the present disclosure;

Figure 3 is a schematic interface diagram of the process of creating a VPC according to an embodiment of the present disclosure;

Figure 4 is a schematic diagram of an interface for creating a peer-to-peer connection according to an embodiment of the present disclosure;

Figure 5 is a schematic diagram of an interface for creating an associated subnet according to an embodiment of the present disclosure;

Figure 6 is a complete schematic diagram of a system for implementing a peer-to-peer connection method between subnets according to an embodiment of the present disclosure;

Figure 7 is a schematic flowchart of a method for implementing peer-to-peer connections between subnets according to another embodiment of the present disclosure;

Figure 8 is a schematic flowchart of a method for implementing peer-to-peer connections between subnets according to yet another embodiment of the present disclosure;

Figure 9 is a schematic flowchart of a method for implementing peer-to-peer connections between subnets according to yet another embodiment of the present disclosure;

Figure 10 is a structural block diagram of a device for implementing peer-to-peer connections between subnets according to an embodiment of the present disclosure;

Figure 11 is a structural block diagram of a device for implementing peer-to-peer connections between subnets according to another embodiment of the present disclosure;

Figure 12 is a structural block diagram of a device for implementing peer-to-peer connections between subnets according to yet another embodiment of the present disclosure;

Figure 13 is a structural block diagram of a device for implementing peer-to-peer connections between subnets according to yet another embodiment of the present disclosure;

Figure 14 is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present disclosure.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments These are some embodiments of the present disclosure, but not all embodiments. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without making creative efforts fall within the scope of protection of this disclosure.

In current cloud computing technology, due to enterprises' needs for network security and network isolation, VPC (Virtual Private Cloud) technology has emerged. VPC is used to construct an isolated network environment, and the networks between different VPCs are blocked. After a user creates a VPC, a default router is automatically created within the VPC. Then, the user can continue to create a network within the VPC. After the network is successfully created, it will automatically connect to the default router, and different networks connected to the default router are interconnected. That is, network interconnection within VPCs and network isolation between VPCs. For details, see the schematic diagram of network interconnection within VPCs shown in Figure 1.

In order to ensure the network isolation between VPCs, designated subnets between some VPCs can communicate with each other, and peering connection technology came into being. In traditional peer-to-peer connection solutions, users usually need to perform tedious configuration and management on hardware network devices. The operations are complex and require a large investment in human resources, making the enterprise's labor costs high.

In order to solve the above problems, embodiments of the present disclosure propose a method for implementing peer-to-peer connections between subnets, as shown in Figure 2. The execution subject of the method may be a cloud platform. The process of the method includes the following steps:

Step S201: Obtain the request information and network configuration information issued by the user.

Optionally, in the embodiment of the present disclosure, the cloud platform is closely related to the user and receives the user's request information and network configuration information. It will obtain the user's desired connection between one subnet in a VPC and another according to the request information. A subnet within the VPC implements peer-to-peer connections to meet data communication requirements. At the same time, the user's network configuration information for these subnets is also obtained.

It can be understood that VPC is a private cloud, so in this disclosed embodiment, the two VPCs are called VPC1 (i.e., local virtual private cloud) and VPC2 (i.e., peer virtual private cloud); a subnet within VPC1 It can be called VM1 (i.e., the first subnet), and a subnet in VPC1 can be called VM2 (i.e., the second subnet); network configuration information mainly includes network type, network segment and network segment ID, router, etc.

Step S202: Obtain the first subnet to which the local virtual private cloud is to be connected, the first network to which the first subnet belongs, and the second subnet and second subnet to which the opposite end's virtual private cloud is to be connected based on the request information and network configuration information. The second network to which it belongs, as well as the local virtual private cloud virtual router and the opposite virtual private cloud virtual router, where the first subnet and the second subnet are network objects that implement peer-to-peer connections and the first subnet and the second subnet The network addresses do not overlap.

Optionally, see Figure 3 for the specific process of creating a VPC. Figure 3 includes the name, network type, physical network, IP type, IPV4 address, etc. that need to be configured when adding a subnet to the VPC. Further, subnets are added according to the user's request information, and then some network information of each subnet is determined according to the network configuration information input by the user and filled in the corresponding positions in Figure 3.

After obtaining multiple subnets to be connected, you need to create a peer-to-peer connection, as shown in Figure 4. Fill in the name and select the local virtual data center, local virtual private cloud, peer virtual data center, peer virtual In a private cloud, only one peering connection can be created between two VPCs.

After the peer-to-peer connection is successfully created, the cloud platform uses the Java NETCONF library to connect to physical network devices such as switches, and sends XML requests to the switches. After subsequent switch configurations, the cloud platform accepts the switch's response and processes it accordingly. For example, the cloud platform uses the Java NETCONF library to connect to the switch with the IP address 192.168.1.1, using admin/admin as the username and password. Then, the cloud platform sends an XML request to the switch with the IP address 192.168.1.1. The request obtains the information of the interface named eth-trunk1 and prints the response. Finally, the cloud platform disconnects from the switch.

At the same time, after the peer-to-peer connection is successfully created, a new piece of data will be generated in the peer-to-peer connection list to prompt that the peer-to-peer connection is successfully created.

So far, the two VPCs have the basis for traffic interoperability. However, if you want to connect the two specific subnets in the VPCs at both ends, you need to further create associated subnets, as shown in Figure 5. Fill in the local subnet in Figure 5. (i.e. the first subnet) and the peer subnet (i.e. the second subnet).

It should be noted that there can be multiple first subnets, and there can also be multiple second subnets. The subnets at both ends have a many-to-many relationship. In addition, the network addresses of the first subnet and the second subnet do not overlap, that is, 1. The CIDR (Classless Inter-Domain Routing, Classless Inter-Domain Routing) of the local/opposite subnet cannot overlap. 2. Among the subnets associated with this terminal's subnet, there cannot be a subnet that overlaps with the CIDR of the opposite terminal's subnet. 3. In other subnets within the local virtual private cloud, there cannot be a subnet that overlaps with the CIDR of the peer subnet. 4. In the subnet associated with the peer subnet, there cannot be a subnet that overlaps with the CIDR of this terminal's subnet. 5. In other subnets in the peer virtual private cloud, there cannot be subnets that overlap with the CIDR of the local subnet.

It can be seen from the above that according to the user request information, the first subnet (ie VM1) to be connected to the local virtual private cloud (ie VPC1) can be obtained. According to the user request information, the to-be-connected subnet of the opposite end virtual private cloud (ie VPC2) can be obtained. The second subnet (i.e. VM2).

In addition, according to the network configuration information input by the user, the network segment 192.168.1.0/24 in Figure 3 can be obtained, which is the first network (or called the first network address) of the first subnet. According to the network configuration information input by the user, The second network (or second network address) of the second subnet can be obtained, and the network segment can be 192.168.2.0/24.

In addition, each VPC will automatically create a default router, such as the local virtual private cloud virtual router and the opposite virtual private cloud virtual router. Of course, the local virtual private cloud virtual router and the opposite virtual private cloud virtual router can also be configured based on the user. Generated from the input network configuration information.

Step S203: Determine the first virtual router in the first switch corresponding to the local virtual private cloud virtual router according to the router mapping relationship, and determine the second virtual router in the first switch corresponding to the opposite virtual private cloud virtual router according to the router mapping relationship. Virtual router, wherein the router mapping relationship stores the corresponding relationship between each virtual router in each switch and the local virtual private cloud virtual router or the opposite end virtual private cloud virtual router.

Optionally, in this embodiment of the present disclosure, since the cloud platform can be understood as a portal for receiving some information from users, and the actual data transmission or data communication should be implemented by switches, the embodiment of this disclosure uses leaf-spine. Architecture, which includes a leaf switch (i.e., the first switch) and a spine switch (which is only an intermediary that sends data packets transmitted by the first switch to the border (border) switch (i.e., the second switch)). For this disclosure Implementing peer-to-peer connections between subnets does not have a major impact, so the embodiments of this disclosure will not elaborate too much). It should be noted that the leaf-spine architecture used in the embodiments of the present disclosure can improve the flexibility and scalability of the network topology, support many-to-many subnet associations, and meet the needs of different business scenarios.

As can be seen from the above description, in order to realize the peer-to-peer connection between the first subnet and the second subnet and realize the transmission of data, the embodiment of the present disclosure needs to go through the first switch and the second switch, and the cloud platform currently only communicates with The first switch is connected, as shown in Figure 6. Therefore, the embodiment of the present disclosure needs to create a first virtual router corresponding to the local virtual private cloud virtual router in the first switch according to the router mapping relationship (i.e., in Figure 6 VRF1 (Virtual Router Forward, virtual route forwarding) creates a second virtual router (ie, VRF2 in Figure 6) corresponding to the peer virtual private cloud virtual router in the first switch according to the router mapping relationship.

Step S204: Send the data packet sent by the first subnet to the first virtual router through the first network.

Optionally, after determining the first virtual router corresponding to the local virtual private cloud virtual router in the first switch, since a first network (192.168.1.0/24) is created in VPC1, the first network It will correspond to the vlan on the first switch (that is, vlan 1001 192.168.1.0/24 in Figure 6). The newly created first network will automatically connect to the default router (that is, the local virtual private cloud virtual router), and then you can The data packet sent by the first subnet is sent to the first virtual router through the first network.

Step S205: Receive the data packet returned from the second virtual router.

Optionally, as can be seen from Figure 6, the cloud platform is directly connected to the first switch, so the peer virtual private cloud of the cloud platform will receive the data packet returned from the second virtual router of the first switch.

Step S206: Send the data packet to the second subnet of the second network.

Optionally, in the peer virtual private cloud, the peer virtual private cloud virtual router will send the data packet to the second subnet of the second network that requests to establish a connection with the first subnet, thereby realizing the The first subnet and the second subnet in VPC2 are connected to each other.

In the embodiment of the present disclosure, the leaf-spine architecture is used to obtain the first switch that needs to be relied upon to achieve subnet peer-to-peer connection between the local virtual private cloud and the opposite virtual private cloud of the cloud platform, and determine the first switch based on the router mapping relationship. The first virtual router in the switch corresponds to the local virtual private cloud virtual router, and the second virtual router in the first switch corresponds to the opposite virtual private cloud virtual router, thereby completing the first virtual private cloud to be connected. The data packet sent by the subnet is transmitted to the first virtual router of the first switch, and then the data packet returned by the second virtual router of the first switch is received and sent to the second subnet of the second network, and then It can not only realize intercommunication between different VPCs, but also control the specific interoperable subnets in a fine-grained manner, which not only meets the security requirements of network isolation between VPCs, but also meets the requirements of mutual communication between designated subnets between VPCs, and thus It solves the problem that in traditional peer-to-peer connection solutions, users usually need to perform cumbersome configuration and management on hardware network devices, which wastes human resources.

In some optional implementations, embodiments of the present disclosure propose a method for implementing peer-to-peer connections between subnets. The execution subject of the method may be the first switch. As shown in Figure 7, the process of the method includes the following steps:

Step S701: The first virtual router receives a data packet sent from the first network of the local virtual private cloud. There is a mapping relationship between the first virtual router of the first switch and the local virtual private cloud virtual router. The data packet is the local virtual private cloud. Data sent from the first subnet to be connected in the first network of the end virtual private cloud;

Step S702: Send the data packet to the third virtual router in the second switch, where there is a mapping relationship between the first virtual router and the third virtual router;

Step S703: The second virtual router receives the data packet returned from the fourth virtual router in the second switch, where there is a mapping relationship between the second virtual router and the fourth virtual router;

Step S704: The second virtual router sends the data packet to the opposite virtual private cloud.

Optionally, in the embodiment of the present disclosure, the first switch is used as the execution subject. As shown in Figure 6, the first virtual router VRF1 of the first switch receives a data packet from the first subnet to be connected in the first network of the local virtual private cloud. It can be understood that because the first switch There is a mapping relationship between the first virtual router and the local virtual private cloud virtual router, so the corresponding first virtual router can be found directly according to the local virtual private cloud virtual router, and then the first virtual router receives the data packet.

As shown in Figure 6, the first switch and the second switch also communicate with each other, so the first switch sends the data packet to the third virtual router VRF3 in the second switch that has a mapping relationship with the first virtual router. Afterwards, the second virtual router VRF2 of the first switch receives the data packet returned from the fourth virtual router VRF4 in the second switch, and then sends the data packet to the opposite end virtual private cloud through the second virtual router.

In the embodiment of the present disclosure, direct communication between the cloud platform and the physical switch reduces the cloud platform's dependence on third-party SDN and improves the cloud platform's network capabilities and product competitiveness.

In some optional implementations, embodiments of the present disclosure propose a method for implementing peer-to-peer connections between subnets. The execution subject of the method may be the second switch. As shown in Figure 8, the process of the method includes the following steps:

Step S801: The third virtual router receives the data packet forwarded by the first virtual router in the first switch. There is a mapping relationship between the third virtual router and the first virtual router, and the data packet is the first network of the local virtual private cloud. Data sent by the first subnet to be connected;

Step S802: Send the data packet to the firewall through the third virtual router;

Step S803: Receive the firewall's verification pass instruction and the returned data packet;

Step S804: Send the data packet to the second virtual router of the first switch via the fourth virtual router of the second switch, where there is a mapping relationship between the second virtual router and the fourth virtual router.

Optionally, it can be concluded from Figure 6 that the second switch communicates with the first switch and the firewall respectively. Specifically, a first virtual router corresponding to the first switch is created on the second switch (border switch). The third virtual router. At this time, there is a mapping relationship between the first virtual router and the third virtual router, and the data packets passing through these VRFs are set to be forwarded to the firewall in the north direction. Since it is necessary to receive the firewall return packet through the second switch, a virtual router for receiving the firewall return packet needs to be set up on the second switch. At this time, if it does not exist on the second switch, create a VRF, that is, the second switch will receive the firewall return packet. The fourth virtual router of the second switch is used to receive return packets from the firewall.

It can be concluded from Figure 6 that the third virtual router of the second switch receives the data packet forwarded by the first virtual router in the first switch, and then sends the data packet to the firewall through the third virtual router, and then receives the data packet back. The firewall verifies the passed instruction of the data packet and the returned data packet, and then the second switch uses the fourth virtual router to send the received returned data packet to the second virtual router of the first switch. It can be understood that there is a mapping relationship between the fourth virtual router of the second switch and the second virtual router of the first switch, so the fourth virtual router can directly transfer the return data packet after receiving the return data packet. The return packet is sent to the second virtual router.

In addition, only after the firewall passes the verification of the data packet, the data packet will be sent back to the second switch, otherwise the data packet will be discarded directly.

In the embodiments of the present disclosure, implementation based on hardware switches and firewalls can provide more reliable and efficient network transmission capabilities compared to pure software implementation.

In some optional implementations, embodiments of the present disclosure propose a method for implementing peer-to-peer connections between subnets. The execution subject of the method may be a firewall. As shown in Figure 9, the process of the method includes the following steps:

Step S901: Receive a data packet sent by the third virtual router in the second switch, where the data packet is data sent by the first subnet to be connected in the first network of the local virtual private cloud;

Step S902, obtain the source address and destination address of the data packet;

Step S903: Match the preset rules according to the source address and the target address to obtain a matching result, where the preset rules are used to characterize the original source address and the original target address;

Step S904: Issue a verification pass instruction and a data packet according to the matching result, and send the data packet to the fourth virtual router of the second switch.

Optionally, according to the above embodiment, the associated subnets: after the first subnet and the second subnet are set up successfully, correct preset rules are issued to the firewall according to the network segments of these subnets. The preset rules here are: The rules are the original source and original destination addresses for these subnets. Then, after receiving the data packet sent by the third virtual router in the second switch, the firewall can check whether the source address and destination address of the data packet fall within the original source address and original destination address of the subnet. If the original source address and the original destination address of the network are within the original source address and the original destination address of the network, the matching result is that the verification is passed, and the data packet is returned to the fourth virtual router of the second switch; otherwise, the matching result is that the verification fails and the data packet is discarded.

Among them, the process of the cloud platform delivering the firewall configuration according to the embodiment of the present disclosure is based on NETCONF (Network Configuration Protocol). Among them, the NETCONF protocol is used to directly communicate with the first switch, the second switch, and the firewall through the cloud platform, which reduces the cloud platform's dependence on third-party SDN and improves the cloud platform's network capabilities and product competitiveness.

In the embodiment of the present disclosure, a firewall is used to verify whether the data packet meets the preset rules, and the matching result is used as a condition for forwarding the data packet, which improves the security of mutual communication between designated networks between VPCs.

In some optional implementations, embodiments of the present disclosure propose a peer-to-peer connection system between subnets, which is characterized in that the system includes a cloud platform, a first switch, a second switch, and a firewall;

The cloud platform obtains the request information and network configuration information issued by the user;

The cloud platform obtains the first subnet to which the local virtual private cloud is to be connected and the first network to which the first subnet belongs and the second subnet to which the peer virtual private cloud is to be connected and the second subnet to which it belongs based on the request information and network configuration information. The second network, as well as the local virtual private cloud virtual router and the opposite virtual private cloud virtual router, where the first subnet and the second subnet are network objects that implement peer-to-peer connections, and the first subnet and the second subnet are Network addresses do not overlap;

The cloud platform determines the first virtual router in the first switch corresponding to the local virtual private cloud virtual router based on the router mapping relationship, and determines the second virtual router in the first switch corresponding to the opposite virtual private cloud virtual router based on the router mapping relationship. Router, wherein the router mapping relationship stores the corresponding relationship between each virtual router in each switch and the local virtual private cloud virtual router or the opposite end virtual private cloud virtual router;

The cloud platform sends the data packet sent by the first subnet to which the local virtual private cloud is to be connected to the first virtual router through the first network;

After receiving the data packet, the first virtual router of the first switch sends the data packet to the third virtual router of the second switch, where there is a mapping relationship between the third virtual router and the first virtual router;

After receiving the data packet, the third virtual router sends the data packet to the firewall through the third virtual router;

After receiving the data packet, the firewall obtains the source address and destination address of the data packet;

The firewall matches the preset rules according to the source address and the destination address to obtain the matching result, where the preset rules are used to characterize the original source address and the original destination address;

The firewall issues verification instructions and data packets based on the matching results, and sends the data packets to the fourth virtual router of the second switch;

After receiving the data packet, the fourth virtual router sends the data packet to the second virtual router of the first switch through the fourth virtual router, where there is a mapping relationship between the second virtual router and the fourth virtual router;

After receiving the data packet, the second virtual router sends the data packet to the opposite virtual private cloud;

After receiving the data packet, the peer virtual private cloud virtual router of the cloud platform sends the data packet to the second subnet of the second network.

Optionally, in this embodiment of the present disclosure, taking the mutual communication and data transmission of designated subnets between two VPCs as an example, the following description is carried out:

As shown in Figure 6, the peer-to-peer connection system between subnets includes the cloud platform, the first switch, the second switch and the firewall. The specific process is as follows:

The cloud platform receives the request information sent by the user, such as requesting subnet VM1 in VPC1 to communicate with subnet VM2 in VPC2, and obtains the network configuration information sent by the user, such as network segment, network type, etc., peer-to-peer After the connection is created, when VM1 in VPC1 wants to communicate with VM2 in VPC2, the data packet sent by VM1 is sent to the first virtual router on the first switch via the first network 192.168.1.0/24 to which it belongs. The first virtual router then sends the data packet to the third virtual router on the second switch. The third virtual router then sends the data packet to the hardware firewall. If the data packet does not match the preset rules on the firewall, it will be discarded; if it matches the preset rules, the data packet will be sent back to the second switch.

The data packet returned to the fourth virtual router of the second switch will be sent to the second virtual router on the first switch after matching the route. The second virtual router on the first switch will then send the data packet to the second virtual router. Network 192.168.2.0/24, and then sent to the second subnet VM2 within the network. In this way, a network communication between VM1 and VM2 is realized. The reverse VM2 accesses the VM1 data packet transmission path and the same principle.

This disclosed embodiment implements traffic interworking between VPCs based on the capabilities of the switch. Based on the capabilities of the hardware firewall, fine-grained control is further achieved, and the interoperability between any networks within the two VPCs can be controlled, instead of all subnets connected to the default routers of the two VPCs. It not only ensures isolation but also realizes traffic intercommunication between designated subnets, and leverages the capabilities of hardware network equipment to provide more reliable and efficient network transmission capabilities than pure software implementation.

Based on the contents of the above embodiments, as an optional embodiment, if it is necessary to realize that designated subnets between multiple VPCs cannot communicate with each other, then only the preset rules of the firewall need to be modified so that the firewall receives The source address and destination address of the data packet cannot always be included in the original source address and original destination address, or after the designated subnets between multiple VPCs are communicated with each other, the remaining subnets in each VPC are not listed. Because mutual communication cannot be achieved.

This embodiment also provides a device for implementing peer-to-peer connections between subnets. The device is used to implement the above embodiments and preferred implementations. What has already been described will not be described again. As used below, the term "module" may be a combination of software and/or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and contemplated.

This embodiment provides a device for realizing peer-to-peer connections between subnets. The device is a cloud platform. As shown in Figure 10, the device includes:

The first acquisition module 1001 is used to acquire the request information and network configuration information issued by the user;

The first obtaining module 1002 is used to obtain the first subnet to which the local virtual private cloud is to be connected, the first network to which the first subnet belongs, and the second subnet to which the opposite end's virtual private cloud is to be connected based on the request information and network configuration information. , the second network to which the second subnet belongs, as well as the local virtual private cloud virtual router and the opposite end virtual private cloud virtual router, where the first subnet and the second subnet are network objects that implement peer-to-peer connections and the first subnet Does not overlap with the network address of the second subnet;

Determining module 1003, configured to determine the first virtual router in the first switch corresponding to the local virtual private cloud virtual router according to the router mapping relationship, and determine the first virtual router in the first switch corresponding to the opposite end virtual private cloud virtual router according to the router mapping relationship. The second virtual router, wherein the router mapping relationship stores the corresponding relationship between each virtual router in each switch and the local virtual private cloud virtual router or the opposite end virtual private cloud virtual router;

The first sending module 1004 is used to send data packets sent by the first subnet to the first virtual router through the first network;

The first receiving module 1005 is used to receive data packets returned from the second virtual router;

The second sending module 1006 is used to send the data packet to the second subnet of the second network.

In the embodiment of the present disclosure, the leaf-spine architecture is used to obtain the first switch that needs to be relied upon to achieve subnet peer-to-peer connection between the local virtual private cloud and the opposite virtual private cloud of the cloud platform, and determine the first switch based on the router mapping relationship. The first virtual router in the switch corresponds to the local virtual private cloud virtual router, and the second virtual router in the first switch corresponds to the opposite virtual private cloud virtual router, thereby completing the first virtual private cloud to be connected. The data packet sent by the subnet is transmitted to the first virtual router of the first switch, and then the data packet returned by the second virtual router of the first switch is received and sent to the second subnet of the second network, and then It can not only realize intercommunication between different VPCs, but also control the specific interoperable subnets in a fine-grained manner, which not only meets the security requirements of network isolation between VPCs, but also meets the requirements of mutual communication between designated subnets between VPCs, and thus It solves the problem that in traditional peer-to-peer connection solutions, users usually need to perform cumbersome configuration and management on hardware network devices, which wastes human resources.

In some optional implementations, the first obtaining module 1002 includes:

The first determination unit is configured to determine the first subnet to which the local virtual private cloud is to be connected and the second subnet to which the opposite end virtual private cloud is to be connected based on the request information;

The second determination unit is configured to determine the local virtual private cloud virtual router, the opposite virtual private cloud virtual router, the first network, and the second network according to the network configuration information.

In some optional implementations, there is at least one first subnet and at least one second subnet.

This embodiment provides a device for implementing peer-to-peer connections between subnets. The device is a first switch. As shown in Figure 11, the device includes:

The second receiving module 1101 is used by the first virtual router to receive data packets from the first network of the local virtual private cloud, where there is a mapping relationship between the first virtual router of the first switch and the local virtual private cloud virtual router. , the data packet is data sent by the first subnet to be connected in the first network of the local virtual private cloud;

The third sending module 1102 is used to send the data packet to the third virtual router in the second switch, where there is a mapping relationship between the first virtual router and the third virtual router;

The third receiving module 1103 is configured for the second virtual router to receive the data packet returned from the fourth virtual router in the second switch, where there is a mapping relationship between the second virtual router and the fourth virtual router;

The fourth sending module 1104 is used by the second virtual router to send the data packet to the opposite virtual private cloud.

This embodiment provides a device for implementing peer-to-peer connections between subnets. The device is a second switch. As shown in Figure 12, the device includes:

The fourth receiving module 1201 is used for the third virtual router to receive the data packet forwarded by the first virtual router in the first switch, where there is a mapping relationship between the third virtual router and the first virtual router, and the data packet is local virtual private Data sent by the first subnet to be connected in the first network of the cloud;

The fifth sending module 1202 is used to send the data packet to the firewall through the third virtual router;

The fifth receiving module 1203 is used to receive the verification pass instruction of the firewall and the returned data packet;

The sixth sending module 1204 is configured to send the data packet to the second virtual router of the first switch through the fourth virtual router, where there is a mapping relationship between the second virtual router and the fourth virtual router.

This embodiment provides a device for realizing peer-to-peer connections between subnets. The device is a firewall. As shown in Figure 13, the device includes:

The sixth receiving module 1301 is used to receive data packets sent by the third virtual router in the second switch, where the data packets are data sent by the first subnet to be connected in the first network of the local virtual private cloud;

The second acquisition module 1302 is used to obtain the source address and destination address of the data packet;

The second obtaining module 1303 is used to match the preset rules according to the source address and the target address to obtain the matching result, where the preset rules are used to characterize the original source address and the original target address;

The seventh sending module 1304 is configured to issue verification passing instructions and data packets according to the matching results, and send the data packets to the fourth virtual router of the second switch.

In this embodiment, the device for realizing peer-to-peer connections between subnets is presented in the form of a functional unit, where the unit refers to an ASIC circuit, a processor and memory that executes one or more software or fixed programs, and/or other devices that can Devices that provide the above functionality.

Further functional descriptions of the above-mentioned modules and units are the same as those in the above-mentioned corresponding embodiments, and will not be described again here.

An embodiment of the present disclosure also provides a computer device having the device for realizing peer-to-peer connection between subnets shown in the above-mentioned FIG. 10 or FIG. 11 or FIG. 12 or FIG. 13 .

Please refer to Figure 14. Figure 14 is a schematic structural diagram of a computer device provided by an optional embodiment of the present disclosure. As shown in Figure 14, the computer device includes: one or more processors 10, a memory 20, and a device for connecting The interfaces of each component include high-speed interfaces and low-speed interfaces. Various components communicate with each other using different buses and can be installed on a common motherboard or in other ways as needed. The processor may process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of the GUI on an external input/output device, such as a display device coupled to the interface. In some alternative implementations, multiple processors and/or multiple buses may be used with multiple memories and multiple memories, if desired. Likewise, multiple computer devices may be connected, each device providing part of the necessary operation (eg, as a server array, a set of blade servers, or a multi-processor system). Figure 14 takes a processor 10 as an example.

The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The above-mentioned hardware chip can be an application-specific integrated circuit, a programmable logic device or a combination thereof. The above-mentioned programmable logic device may be a complex programmable logic device, a field programmable logic gate array, a general array logic or any combination thereof.

The memory 20 stores instructions that can be executed by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

The memory 20 may include a stored program area and a stored data area, wherein the stored program area may store an operating system and an application program required for at least one function; the stored data area may store the use of the computer device according to the presentation of a small program landing page. The data created etc. In addition, the memory 20 may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage device. In some optional implementations, the memory 20 may optionally include memories remotely located relative to the processor 10 , and these remote memories may be connected to the computer device through a network. Examples of the above-mentioned networks include but are not limited to the Internet, intranets, local area networks, mobile communication networks and combinations thereof.

The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memories.

The computer device also includes a communication interface 30 for the computer device to communicate with other devices or communication networks.

The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be recorded in the storage medium, or can be implemented as original storage downloaded through the network. Computer code in a remote storage medium or a non-transitory machine-readable storage medium and to be stored in a local storage medium such that the methods described herein may be stored on a computer using a general purpose computer, a special purpose processor, or programmable or special purpose hardware Such software processing on storage media. The storage medium may be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk or a solid state drive, etc.; further, the storage medium may also include a combination of the above types of memories. It can be understood that a computer, processor, microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by the computer, processor or hardware, the above implementations are implemented. The method illustrated.

Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the disclosure, and such modifications and variations fall within the scope of the appended rights. within the scope of the requirements.

Claims (12)

1. A method for implementing peer-to-peer connection between subnetworks, the method being applied to a cloud platform, the method comprising:

acquiring request information and network configuration information issued by a user;

obtaining a first subnet to be connected with a local virtual private cloud, a first network to which the first subnet belongs, a second subnet to which an opposite-end virtual private cloud is to be connected, a second network to which the second subnet belongs, a local virtual private cloud virtual router and an opposite-end virtual private cloud virtual router according to the request information and the network configuration information, wherein the first subnet and the second subnet are network objects for realizing peer-to-peer connection, and network addresses of the first subnet and the second subnet are not overlapped;

determining a first virtual router corresponding to the home-end virtual private cloud virtual router in a first switch according to a router mapping relation, and determining a second virtual router corresponding to the opposite-end virtual private cloud virtual router in the first switch according to the router mapping relation, wherein the router mapping relation stores the corresponding relation between each virtual router in each switch and the home-end virtual private cloud virtual router or the opposite-end virtual private cloud virtual router;

Transmitting a data packet sent by a first subnet to the first virtual router through the first network;

receiving the data packet returned from the second virtual router;

the data packet is sent to the second subnetwork of the second network.

2. The method of claim 1, wherein the obtaining, according to the request information and the network configuration information, a first subnet to which a home-end virtual private cloud is to be connected, a first network to which the first subnet belongs and a second subnet to which a peer-end virtual private cloud is to be connected, a second network to which the second subnet belongs, a home-end virtual private cloud virtual router, and a peer-end virtual private cloud virtual router includes:

determining the first subnet to be connected with the home terminal virtual private cloud and the second subnet to be connected with the opposite terminal virtual private cloud according to the request information;

and determining the home terminal virtual private cloud virtual router, the opposite terminal virtual private cloud virtual router, the first network and the second network according to the network configuration information.

3. The method according to claim 1 or 2, wherein the first subnetwork is at least one and the second subnetwork is at least one.

4. A method for implementing peer-to-peer connection between subnetworks, said method being applied to a first switch, said method comprising:

the method comprises the steps that a first virtual router receives a data packet sent by a first network from a home terminal virtual private cloud, wherein a mapping relation exists between the first virtual router of a first switch and the home terminal virtual private cloud virtual router, and the data packet is data sent by a first subnet to be connected in the first network of the home terminal virtual private cloud;

the data packet is sent to a third virtual router in a second switch, wherein a mapping relation exists between the first virtual router and the third virtual router;

the second virtual router receives the data packet returned by the fourth virtual router in the second switch, wherein the second virtual router and the fourth virtual router have a mapping relation;

and the second virtual router sends the data packet to the opposite-end virtual private cloud.

5. A method for implementing peer-to-peer connection between subnetworks, said method being applied to a second exchange, said method comprising:

a third virtual router receives a data packet forwarded by a first virtual router in a first switch, wherein the third virtual router and the first virtual router have a mapping relation, and the data packet is data sent by a first subnet to be connected in a first network of a local virtual private cloud;

Transmitting the data packet to a firewall through the third virtual router;

receiving a verification passing instruction of the firewall and the returned data packet;

and sending the data packet to a second virtual router of the first switch through a fourth virtual router, wherein the second virtual router and the fourth virtual router have a mapping relation.

6. A method for implementing peer-to-peer connection between subnetworks, said method being applied to a firewall, said method comprising:

receiving a data packet sent by a third virtual router in a second switch, wherein the data packet is data sent by a first subnet to be connected in a first network of a local virtual private cloud;

acquiring a source address and a target address of the data packet;

according to the source address and the target address, a preset rule is matched to obtain a matching result, wherein the preset rule is used for representing an original source address and an original target address;

and issuing a verification passing instruction and the data packet according to the matching result, and sending the data packet to a fourth virtual router of the second switch.

7. The system is characterized by comprising a cloud platform, a first switch, a second switch and a firewall;

The cloud platform acquires request information and network configuration information issued by a user;

the cloud platform obtains a first subnet to be connected with a local virtual private cloud, a first network to which the first subnet belongs, a second subnet to which an opposite-end virtual private cloud is to be connected, a second network to which the second subnet belongs, a local virtual private cloud virtual router and an opposite-end virtual private cloud virtual router according to the request information and the network configuration information, wherein the first subnet and the second subnet are network objects for realizing peer-to-peer connection, and network addresses of the first subnet and the second subnet are not overlapped;

the cloud platform determines a first virtual router corresponding to the home-end virtual private cloud virtual router in the first switch according to a router mapping relation, and determines a second virtual router corresponding to the opposite-end virtual private cloud virtual router in the first switch according to the router mapping relation, wherein the router mapping relation stores a corresponding relation between each virtual router in each switch and the home-end virtual private cloud virtual router or the opposite-end virtual private cloud virtual router;

The cloud platform sends a data packet sent by a first subnet to be connected with a local virtual private cloud to the first virtual router through the first network;

after the first virtual router of the first switch receives the data packet, the data packet is sent to a third virtual router of a second switch, wherein the third virtual router and the first virtual router have a mapping relation;

after the third virtual router receives the data packet, the data packet is sent to a firewall through the third virtual router;

after the firewall receives the data packet, acquiring a source address and a target address of the data packet;

the firewall matches a preset rule according to the source address and the target address to obtain a matching result, wherein the preset rule is used for representing an original source address and an original target address;

the firewall issues a verification passing instruction and the data packet according to the matching result, and sends the data packet to a fourth virtual router of the second switch;

after the fourth virtual router receives the data packet, the data packet is sent to a second virtual router of the first switch through the fourth virtual router, wherein the second virtual router and the fourth virtual router have a mapping relation;

After the second virtual router receives the data packet, the data packet is sent to the opposite-end virtual private cloud;

and after receiving the data packet, the opposite-end virtual private cloud virtual router of the cloud platform sends the data packet to the second subnet of the second network.

8. A device for implementing peer-to-peer connection between subnetworks, the device being a cloud platform, the device comprising:

the first acquisition module is used for acquiring request information and network configuration information issued by a user;

the first obtaining module is configured to obtain a first subnet to be connected to the home terminal virtual private cloud, a first network to which the first subnet belongs, a second subnet to which the opposite terminal virtual private cloud is to be connected, a second network to which the second subnet belongs, a home terminal virtual private cloud virtual router, and an opposite terminal virtual private cloud virtual router according to the request information and the network configuration information, where the first subnet and the second subnet are network objects for implementing peer-to-peer connection, and network addresses of the first subnet and the second subnet are not overlapped;

the determining module is used for determining a first virtual router corresponding to the home-end virtual private cloud virtual router in the first switch according to a router mapping relation, and determining a second virtual router corresponding to the opposite-end virtual private cloud virtual router in the first switch according to the router mapping relation, wherein the router mapping relation stores the corresponding relation between each virtual router in each switch and the home-end virtual private cloud virtual router or the opposite-end virtual private cloud virtual router;

The first sending module is used for sending the data packet sent by the first subnet to the first virtual router through the first network;

the first receiving module is used for receiving the data packet returned by the second virtual router;

and the second sending module is used for sending the data packet to the second subnet of the second network.

9. A device for implementing peer-to-peer connection between subnetworks, said device being a first switch, said device comprising:

the second receiving module is used for receiving a data packet sent by a first network from a local virtual private cloud by a first virtual router, wherein the first virtual router of the first switch and the local virtual private cloud virtual router have a mapping relation, and the data packet is data sent by a first subnet to be connected in the first network of the local virtual private cloud;

the third sending module is used for sending the data packet to a third virtual router in the second switch, wherein the first virtual router and the third virtual router have a mapping relation;

the third receiving module is used for receiving the data packet returned by the fourth virtual router in the second switch by the second virtual router, wherein the second virtual router and the fourth virtual router have a mapping relation;

And the fourth sending module is used for sending the data packet to the opposite-end virtual private cloud by the second virtual router.

10. A device for implementing peer-to-peer connection between subnetworks, said device being a second switch, said device comprising:

a fourth receiving module, configured to receive, by using a third virtual router, a data packet forwarded by a first virtual router in a first switch, where the third virtual router has a mapping relationship with the first virtual router, and the data packet is data sent by a first subnet to be connected in a first network of a home terminal virtual private cloud;

a fifth sending module, configured to send the data packet to a firewall through the third virtual router;

a fifth receiving module, configured to receive the verification passing instruction of the firewall and the returned data packet;

and the sixth sending module is used for sending the data packet to a second virtual router of the first switch through a fourth virtual router, wherein the second virtual router and the fourth virtual router have a mapping relation.

11. A device for implementing peer-to-peer connection between subnetworks, said device being a firewall, said device comprising:

A sixth receiving module, configured to receive a data packet sent by a third virtual router in the second switch, where the data packet is data sent by a first subnet to be connected in a first network of the home terminal virtual private cloud;

the second acquisition module is used for acquiring the source address and the target address of the data packet;

the second obtaining module is used for obtaining a matching result according to a preset rule matched with the source address and the target address, wherein the preset rule is used for representing an original source address and an original target address;

and the seventh sending module is used for sending the verification passing instruction and the data packet according to the matching result and sending the data packet to a fourth virtual router of the second switch.

12. A computer device, comprising:

a memory and a processor, the memory and the processor being communicatively connected to each other, the memory having stored therein computer instructions, the processor executing the computer instructions to perform the method of implementing peer-to-peer connection between sub-networks as claimed in any one of claims 1 to 3 or claim 4 or claim 5 or claim 6.