WO2008014723A1 - Method and device for implementing vpn based on ipv6 address structure - Google Patents

Abstract

A method and a device for implementing Virtual Private Networking based on IPv6 address structure, mostly including: firstly, the VPN local address and the VPN global address of the respective site in Virtual Private Networking VPN are set based on the IPv6 address structure; then, the route information of the respective site in VPN is established based on the set local address and the set global address, and depending on the route information, the VPN message is transferred through the respective site in VPN. Not only the VPN information can be contained in the IPv6 address, but also according to the difference of the target address prefix, the respective site can access Internet and VPN; when the autonomous system is crossed, only the route of the VPN site and the VPN group is distributed to the adjacent autonomous system.

Description

 The present invention relates to the field of communications, and in particular, to a technology for implementing a virtual private network based on an IPv6 address structure. Background of the invention

The increase in the length of the IPv6 address allows the IPv6 address to be more clearly layered, for example:

 The IPv6 address is divided into multiple global routing levels. At the top level of the hierarchy, the Internet address authority assigns address blocks to the top-level aggregation (TLA), which can be assigned to permanent Internet service providers and telecom operators. The TLA redistributes the address block to the next level of aggregation (NLA), which is assigned to large Internet service providers and some global Internet organizations. The NLA (provider) can divide its address down to its subscribers. Since the NLA addresses under the same TLA have the same TLA prefix, the routing efficiency is better. Moreover, subscribers with the same provider have the same NLA address prefix.

 The aggregation-based allocation scheme is based on a number of high-level switching nodes through which permanent Internet service providers and telecom operators are interconnected. Because information exchange is global, these switching nodes with IPv6 address classes have a certain geographical distribution. Typically, these nodes are provided to large operators.

 In the IPV6-based address aggregation structure, the first three addresses are address types such as unicast or multicast. The next 13 bits are assigned to different TLAs in the world. The next 32 bits are assigned to the next level of providers and orderers.

 The next level of aggregation can be divided into NLA address fields to create their own level, such as mapping NLA addresses to existing larger ISPs, subdividing them to smaller ISPs, and so on.

 As the Internet continues to expand, the application of IPv6 class routing is the only way for the backbone router to control the routing table. By based on the aggregated address level, the subscriber's internal network segment can be accessed through the advanced aggregation point, which allows the backbone router to summarize the routing table through the TLA address prefix.

 A higher level (hierarchical) router can only look at the TLA address prefix to quickly calculate the route. The large hierarchical address space of IPv6 allows for more distributed address allocation.

 The aggregate-based address is only part of the IPv6 address space, and other address ranges are assigned to the site-local address and the link-local address when multicasting, or when there is only one unique address within a limited range. The following describes the concept of addresses that can be used in the address space of IPV6:

1. Link-local address: Used internally by the enterprise, not used by public registries. Link-local addresses are used for a link-wide application, or as a temporary, "over" before some sites get global unicast addresses. """"bootstrapping") site address.

 2. Site-local address: The address used in the site, similar to the IPv4 private network address.

 3. Multicast address: Define a set of interfaces. Packets sent to a multicast address will be sent to all interfaces of the multicast group, and there is no broadcast address in IPV6. The broadcast address is replaced by a multicast address.

4. Multicast address description:

 Ffxl : The local scope of the node, which will not be forwarded out.

 Ffx2 : Link local range, not forwarded by the router. (for link range)

 Ffx5 : Site-local address, will not be forwarded out of the site.

 Ffx8 : Organization local address, will not be forwarded out of the organization. This type of address is controlled by a routing protocol. Ffxe : Worldwide.

 5. Anycast address: Used for a set of interfaces. However, packets forwarded to anycast address will be routed to the nearest interface in the set of interfaces that have the address. The anycast address and the global address are in the same range.

6. IPv6 address embedded in IPv4 address: The IPv6 transition mechanism provides a technology for transmitting IPv6 packets in a tunnel manner through the IPv4 routing structure. An IPv6 node using this technique is assigned to a special IPv6 unicast address, the lower 32 bits of which are IPv4 addresses. This address is called "IPv4-compatible IPv6 address" and has the following format:

16 bits

 32 bits

 80 bits

0000000 0000000 0000 IPV4 address

The "IPv4-compatible IPv6 address" must be a unique global unicast IPv4 address. In addition, an IPv6 address embedded in an IPv4 address is defined. This address uses an IPv6 address to represent an IPv4 node. This address is called "map IPv4 IPv6 address" and has the following format:

16 bits

 32 bits

与本发明有关的现有技术是 IPv6 over BGP/MPLS VPN技术。 80 bits

The prior art related to the present invention is the IPv6 over BGP/MPLS VPN technology.

 In the process of implementing the present invention, the inventors have found that the above prior art has at least the following drawbacks:

 1. MPLS encapsulates IPv6 packets, which brings additional overhead.

 2. The backbone network must be required to support MPLS. Some label distribution protocol, such as the LDP protocol, must be run to bring additional overhead.

 3. The method of crossing the autonomous system is complicated and expensive;

 4. The method of accessing the Internet is complicated;

 5, can not be used for IPv4 site, through the interconnection of IPv6 networks, form a VPN. Summary of the invention

 The embodiment of the invention provides a method and a device for implementing a virtual private network based on an IPv6 address structure, so as to carry the VPN traffic on the pure IPv6 network, and the prior art backbone network must support MPLS, and the MPLS encapsulated IPv6 packet band is adopted. To add overhead issues.

 An embodiment of the present invention provides a method for implementing a virtual private network based on an IPv6 address structure, including: The embodiment of the present invention provides a method for implementing a virtual private network, including:

 Setting a VPN local address and a VPN global address of each site in the virtual private network VPN based on the IPv6 address structure; establishing routing information of each site in the VPN according to the set VPN local address and the VPN global address, and according to the routing information VPN packets are transmitted between sites in the VPN.

 An embodiment of the present invention provides a device for implementing a virtual private network, including:

 The routing information establishing unit is configured to establish routing information of each site in the VPN according to a VPN local address and a VPN global address of each site in the VPN, where the VPN local address and the VPN global address of each site in the VPN are based on

IPv6 address structure setting;

 The VPN packet transmission processing unit is configured to transmit, according to the routing information established by the routing information, a VPN packet exchanged between sites in the VPN.

As can be seen from the technical solution provided by the foregoing embodiments of the present invention, the embodiment of the present invention sets a VPN local address and a VPN global address of each site in the virtual private network VPN based on the IPv6 address structure; and then according to the set local address and global address. Establishing routing information of each site in the VPN, and transmitting VPN packets through each site in the VPN according to the routing information. In the embodiment of the present invention, the IPv6 address is used to accommodate the VPN information, and the forwarding process of the VPN packet and the common IP packet is unified, and the VPN traffic can be carried on the pure IPv6 network, thereby solving the problem that the prior art backbone network must support. MPLS, and the additional overhead caused by MPLS encapsulating IPv6 packets; BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is a schematic diagram of a VPN structure;

 2 is a flow chart of an embodiment of the present invention. The embodiments of the present invention provide a technical solution for implementing a virtual private network based on an IPv6 address structure, which mainly includes: first setting a VPN local address and a VPN global address of each site in a virtual private network VPN based on an IPv6 address structure; The set local address and the global address establish routing information of each site in the VPN, and transmit VPN packets through each site in the VPN according to the routing information.

 In the embodiment of the present invention, after the VPN local address and the VPN global address of each site in the VPN are set based on the IPv6 address structure, the mapping relationship between the VPN local address and the VPN global address is also established, so as to perform VPN according to the mapping relationship. Forwarding of packets.

 In the embodiment of the present invention, the process of establishing the routing information of each site in the VPN according to the local address and the global address, and transmitting the VPN packet between the sites in the VPN according to the routing information may include:

 (1) configuring routing information of each site in the VPN on the PE device in the VPN according to the set local address and the global address;

 The step (1) may specifically include any of the following implementation manners:

 Implementation one

 During initialization, configure the VPN site on the PE device and assign it a VPN site ID.

 When a unicast packet exists in the VPN, the PE device generates an IPv6 aggregation route of each site in the VPN according to the VPN site ID.

 The PE device advertises the IPv6 aggregation route to the P device and/or the destination PE of the VPN through a routing protocol; the P device and/or the destination PE are configured according to the VPN ID information included in the VPN site ID, and the local configuration. of

The VPN IDs in the VPN site ID are compared. If they are the same, the route is saved. Otherwise, the route is discarded.

 Implementation 2

During the initialization, the VPN site is configured with the VPN group ID and the VPN group ID information is assigned to it. When there is a multicast packet in the VPN, the assigned VPN group ID information is added to the multicast through the multicast routing protocol. In each VPN site in the group. Implementation mode three

 During initialization, the PEs of the VPN configure each site in the VPN, and allocate VPN site ID information, ingress route target RT information, and egress RT information for each site.

 When a unicast packet exists in the VPN, the PE device generates IPv6 aggregate routing information according to the VPN site ID information, the ingress RT information, and the egress RT information, and adds the RT extension included in the egress RT information to the IPv6 aggregate routing information. The community attribute is then advertised to the P device and/or destination PE of the VPN through a routing protocol;

 The P device and/or the destination PE compares with the RT extended community attribute information in the locally configured ingress RT information according to the RT extended community attribute information in the VPN route, and if at least one RT extended community attribute information is the same, Then save this route; otherwise discard the route.

 (2) Configuring routing information between the site and its associated site at each site;

The step ( ₂ ) may be configured to statically configure routing information between the VPN site and the associated site at each VPN site; or, by using a routing protocol between the PE device and the PE device at each VPN site, The routing information of the site associated with the site. If the latter implementation is adopted, the corresponding processing may specifically include:

 The VPN routing information is sent to the target PE device by using the site set on the local PE device, where the VPN routing information carries the VPN site ID information of the site;

 When receiving the VPN routing information, the target PE checks whether there is a site belonging to the same VPN as the site set on the local PE according to the VPN site ID information, and if there is a site belonging to the same VPN, The information of the site is added to the routing information of the site set on the local PE.

 (3) transmitting, according to the routing information, VPN packets by each station in the VPN;

 In the step (3), when the packets are forwarded between the sites in the VPN, the corresponding processing may include:

 The source address and the destination address of the VPN packet are configured according to the VPN local address of each site in the set VPN. According to the routing information configured on the site, the standard single/multicast forwarding mechanism is used to forward the VPN packet. Forward to the site corresponding to the destination address.

 In the step (3), when the inbound PE device forwards the packet, the corresponding processing may specifically include any one of the following two methods:

 method one

 The ingress PE analyzes the received packet to obtain a site corresponding to the source address of the packet;

Adding VPN site ID information of the site corresponding to the source address to the packet, and converting the source address into a source VPN global address;

 Finding the routing information of the corresponding destination site according to the destination address carried in the packet, and obtaining the destination VPN site ID information;

 Transmitting the destination address of the packet to the destination VPN global address according to the obtained destination VPN site ID, and forwarding the packet to the corresponding site according to the destination VPN site ID information.

 Way two

 The ingress PE analyzes the received packet to obtain a site corresponding to the source address of the packet;

 The destination address of the packet is converted to the destination VPN global multicast address by adding the VPN site ID information of the corresponding site to the source VPN global address.

 The multicast group information stored on the PE device is searched according to the VPN group ID information, and the destination VPN site ID information is obtained, and the packet is multicasted to the corresponding site according to the destination VPN site ID information.

 In the step (3), when the packet is forwarded by the P device, the corresponding processing may include: when the P device receives the unicast packet, adopts the standard IPv6 route according to the obtained aggregated route of the destination site. The method forwards the packet to the egress PE; or, when the P device receives the multicast packet, searches for the multicast route according to the VPN group ID information in the VPN global multicast address carried in the packet. The information is obtained, and the site ID information of each site in the corresponding multicast group is obtained. Then, the multicast packet is multicasted to each site in the corresponding multicast group according to the obtained site ID information.

 In the step (3), when the egress PE device forwards the packet, the corresponding processing may specifically include any of the following implementation manners:

 Implementation one

 When the egress PE device receives the unicast packet, the source and destination global addresses of the packet are translated into a unicast local address in the VPN.

 Querying and obtaining the local routing information of the corresponding site according to the VPN site ID information in the destination global address, and forwarding the packet according to the obtained local routing information;

 Implementation 2

 When the egress PE device receives the multicast packet, the source global address of the packet is translated into a local address in the VPN.

Searching for and obtaining the local routing information of the corresponding site according to the VPN group ID information in the destination address carried in the packet, and converting the destination global address address into the multicast local locality of the VPN according to the obtained local routing information. Address

 The packet is forwarded according to the group ID information in the multicast local address of the VPN.

 In the step (3), when the VPN site accesses the Internet, the corresponding processing may include: converting, by the VPN site, the source local address of the site in the VPN to the source global address according to the VPN site ID information, and The local address is translated to the Internet global address, and the Internet is accessed based on the converted Internet global address.

 In the embodiment of the present invention, before performing the step (3), the method further includes: configuring, by the ingress PE device, an interface that is connected to the VPN site to receive only the packet whose destination address is a VPN local address and an Internet global address, And refusing to receive the packet whose destination address is the VPN global address; and configuring the P device to reject the packet whose source IP address is the VPN local address.

 In the embodiment of the present invention, before performing the step (3), the method may further include:

 After receiving the packet, the egress PE extracts the VPN site ID information in the source address of the packet, and checks whether the interface that the packet enters the egress PE is obtained by using the VPN site ID information. Site The interface that aggregates routes. If yes, the packet is forwarded through the egress PE. Otherwise, the packet is discarded.

 In the embodiment of the present invention, when the VPN exists in the IPv4 site, the corresponding step (2) may further include: allocating an IPv4 VPN site ID to the IPv4 site on the PE device, and according to the allocated IPv4 site ID. The IPv4 routing information of each IPv4 site is configured on the PE device; or the IPv4 VPN group ID is assigned to the IPv4 site on the PE device, and the allocated IPv4 is configured on the PE device by using a multicast routing protocol. The VPN group ID information is added to each VPN site in the multicast group. The corresponding step (2) may further include: allocating IPv4 VPN site ID information to the IPv4 site on each IPv4 site, and configuring the association with each IPv4 site according to the allocated IPv4 site ID information. IPv4 inter-office IPv4 routing information; or, assigning an IPv4 VPN group ID to the IPv4 site at each IPv4 site, and transmitting the assigned IPv4 VPN group ID information at each IPv4 site through a multicast routing protocol. Join the VPN sites in the multicast group.

 In the embodiment of the present invention, when the IPv4 packet is forwarded through the IPv6 backbone network in the VPN, the step (3) may include any one of the following processing modes:

 Processing method one

 When the ingress PE receives the IPv4 unicast packet, the source IPv4 address of the packet is first analyzed, and the configured IPv4 routing information is searched according to the source address information to obtain the corresponding destination IPv4 address information, and then the The source and destination IPv4 addresses are translated into an IPv6 unicast address of the embedded IPv4, and the IPv4 packet is forwarded according to the destination address;

And when the P device receives the packet, forwarding the packet to the egress according to the IPv6 aggregate routing information. PE equipment;

 The egress device determines, according to the IPv4 VPN site ID information carried in the packet, that the site corresponding to the destination address of the packet is an IPv4 site, and then searches for the IPv4 routing information, and converts the destination IPv6 address into an IPv4 destination address. And forwarding the packet to the corresponding destination site according to the IPv4 destination address;

 Processing method 2

 When receiving the IPv4 multicast packet, the ingress PE first analyzes the source IPv4 address of the packet, and searches for the configured IPv4 routing information according to the source address information to obtain the corresponding destination IPv4 address information, and then The source and destination IPv4 addresses are translated into an IPv6 unicast address with an embedded IPv4, and the IPv4 packet is forwarded in the IPv6 network according to the destination address;

 When the packet arrives at the egress PE device, the egress PE device is based on the IPv4 VPN group carried in the packet.

When the ID information determines that the site corresponding to the destination address of the packet is an IPv4 site, it searches for IPv4 routing information, translates the destination IPv6 address into an IPv4 destination address, and forwards the packet to the IPv4 destination address. Corresponding destination site.

 In summary, the embodiment of the present invention sets a VPN local address and a VPN global address of each site in the virtual private network VPN based on the IPv6 address structure; and then establishes routing information of each site in the VPN according to the set local address and the global address, and According to the routing information, VPN packets are transmitted through each site in the VPN. In the embodiment of the present invention, the IPv6 address is used to accommodate the VPN information, and the forwarding process of the VPN packet and the common IP packet is unified, and the VPN traffic can be carried on the pure IPv6 network, which solves the problem that the prior art backbone network must support MPLS and adopts MPLS encapsulation. Additional overhead caused by IPv6 packets;

 In addition, according to the difference of the destination address prefix, each site can simultaneously access the Internet and

VPN, which is easy to implement; when crossing the autonomous system, only the routes of the VPN site and the VPN group are advertised to the adjacent autonomous system, and the autonomous system border router does not need to store/forward VPN routes, and does not need a multi-layer label stack. In addition, in the embodiment of the present invention, the VPN composition relationship is clear, and the VPN route only needs to carry a fixed-length site ID, which is convenient for processing; and the VPN site prefix is added by the operator PE, and the legality check is performed at the ingress PE. The egress PE is used for RPF check to ensure the security of the VPN. In addition, the IPv4 site does not need to be upgraded to IPv6, and can be interconnected through the IPv6 backbone network to form a VPN.

The first embodiment provided by the embodiment of the present invention is based on a VPN structure provided by a conventional operator as shown in FIG. 1 , and includes a CE device, an ingress PE device, a P device, and an egress PE device in the VPN. The PE device and the P device form a VPN public network, and the CE device and the PE device form a VPN intranet. Set the site in the above device. Each site has an ID. There is one internal/global one. They are called the VPN local site ID and the global site ID. The global site is called the global site. The ID can be the same as the site ID of the VPN public network address, but with a different prefix.

 The specific implementation process is shown in Figure 2, including:

 Step 100: Set a virtual private network VPN local address and a VPN global address of each site based on the IPv6 address structure, and use the site ID to identify each site in the VPN global address.

 The process of setting up a VPN local address is as follows:

 Similar to the link-local address and the site-local address setting method, the VPN local address is set. The VPN local address is valid only in the VPN intranet, and the devices in the VPN intranet access each other.

 The unicast VPN local address structure is set to the structure shown below:

 10 bits I 54- n bits I n bits I 64 bits prefix | reserved | subnet ID interface ID In order to allow the current host and router to use the VPN local address without modification, use the same prefix type as the site-local address, such as 1111111011 Set the VPN local unicast address as follows:

 10 bits I 38 bits I 16 bits I 64 bits

1111111011 reserved subnet ID interface ID Multicast The VPN local address structure is set to the following structure:

4 4 112— n l l ll l l l l | flgs | scop reserved | group ID where the figs field contains 4 bits, as follows:

0 V 0 T Set the V bit (bit 10) in the figs field to 1, indicating that it is a VPN multicast address; to be compatible with RFC3306, set the 11th bit to 0; T bit (bit 12) is set to 1 , identifying that the multicast address is non-permanent. The scop segment (13-16 bits) is 1000, indicating a valid multicast address in the VPN intranet. After this setting, the following format is formed: 80 32

11111111 | 0101 | 1000 reserved | group ID

The VPN global address is used to address the destination address in the VPN on the carrier network, that is, the VPN public network. The operator only cares about how the router arrives at a VPN site and which VPN site it arrives, regardless of how it reaches the VPN internal destination site.

 The VPN global address is different from the global public address. The router must prevent VPN global addresses of different VPNs from reaching each other.

 The process of setting the VPN global address is as follows:

 The unicast VPN global address is set to the following structure:

48- n bits n bits 64 bits vpn global routing prefix subnet ID | interface ID

In order to address a VPN site in the VPN public network, the vpn global routing prefix is set to include a prefix 002, and a VPN Site ID structure; the Subnet ID and the interface ID are only used to save the VPN internal unicast address. It is ignored when addressing on the VPN public network. After this setting, the following structure is formed:

45 bits 16 bits 64 bits

002 VPN site ID subnet ID interface ID

The multicast VPN global address is set to the following structure:

112-n-m

111111111 figs I scop reserved | VPN group ID | group ID The VPN group ID indicates the multicast group that propagates multicast packets between sites in the VPN. When the scop field is set to 1110, it indicates that the address is a globally valid multicast address. The group ID is only used to save the multicast address inside the VPN and is ignored when addressing on the public network. After this setting, the following structure is formed:

8 48 32 32

11111111 | 0101 | 1110 reserved | VPN group ID | group ID The unicast VPN local address and the VPN global address can be mapped to each other. When mapping, the Interface ID and subnet ID fields remain unchanged during mapping. When processing other fields, add different prefixes according to the structural characteristics of the global/local address, and add or clear the VPN site ID information.

 The multicast VPN global address is mapped by the VPN local address. When mapping, set the scop field according to the characteristics of the global/local address, and add or clear the VPN group ID. Step 200: Establish a connection relationship between the sites, that is, a topology relationship of the VPN.

 The establishment of a VPN topology relationship includes the following three methods:

 The first type uses a part of the VPN Site ID field in the unicast VPN global address to identify the VPN, that is, the VPN ID. If some Sites belong to the same VPN network, they have the same VPN ID. The format of the VPN site ID is as follows:

 I 45- m bits | m bits

 VPN ID I Site ID The second method is to add a route attribute to the VPN site ID field in the unicast VPN global address to express the VPN topology. This routing attribute can be in the format of the Route Target (RT) in the BGP extended community attribute.

 In the third mode, a VPN relationship between a site and other associated sites is statically configured on the PE device in the VPN to form a VPN topology relationship.

 Step 300: Configure routing attribute information of each site device in the VPN.

 The specific implementation process of step 300 is as follows:

 Step 310: Configure routing information between the sites in the VPN on the PE.

For the VPN topology relationship formed by the first method in step 200, the PE device configures the VPN during initialization. Each site in the network is assigned a corresponding VPN site ID information, and the PE device generates an IPv6 aggregation route, which is called a VPN site route, for example, 002: VPN site ID: : /48, and routes through the VPN site ID information. The protocol is issued to the P device of the VPN and other PE devices. The destination PE device matches the VPN ID in the locally configured VPN site ID according to the VPN ID information included in the VPN site ID information. If the information is the same, the route is saved. Otherwise, the route is discarded. The specific real-time process includes the following steps:

 Step 311: Set a VPN site in the PE device, and assign a VPN site ID to the PE device.

 Step 312: The PE device generates an IPv6 aggregation route, that is, a VPN site route, according to the VPN site ID. Step 313: The PE device advertises the IPv6 aggregation route to the P device and/or the destination PE of the VPN through a routing protocol.

 Step 314: The P device and/or the destination PE compares the VPN ID information included in the VPN site ID with the VPN ID in the locally configured VPN site ID. If the information is the same, the route is saved; otherwise, the route is saved. Said routing.

 After the above process, the sites belonging to the same VPN are reachable, and the sites that do not belong to the same VPN are unreachable.

 If there is a multicast packet in the VPN, the VPN site ID information is assigned to the VPN site (that is, the VPN site configured for the PE device) and is added to the VPN site through the multicast routing protocol. In the VPN site in the multicast group.

 For the VPN topology relationship formed by the second method in step 200, when only the unicast packets are forwarded in the VPN, the sites in the VPN are configured on the PEs of the VPN, and the VPNs are respectively allocated to the sites. Site ID, entry RT list and exit RT list. Based on the information, the PE device generates an IPv6 aggregation routing information, for example, 002: VPN site ID: : /48, and adds the RT extended community attribute contained in the egress RT list to the P device and other PE devices through the routing protocol. The PE device matches the RT list in the VPN route with the local ingress RT list. If at least one RT extension attribute is the same, the route is saved. Otherwise, the route is discarded. In this way, according to the matching relationship of RT extended attributes, multiple VPN topologies such as full mesh and hub-spoke can be constructed, and intranet (intranet) and extranet can be constructed. External network) and so on. The specific implementation process includes the following steps:

 Step 315: During initialization, configure a site in the VPN through the PE device of the VPN, and allocate VPN site ID information, ingress route target RT information, and exit RT information for each site.

Step 316: The PE device generates IPv6 aggregate routing information according to the VPN site ID information, the ingress RT information, and the egress RT information. Step 317: Add, in the IPv6 aggregate routing information, the RT extended community attribute included in the egress RT information, and advertise the same to the P device and/or the destination PE of the VPN through the routing protocol.

 Step 318: The P device and/or the destination PE compares with the RT extended community attribute information in the locally configured ingress RT information according to the RT extended community attribute information in the VPN route, if at least one RT extended community attribute exists. If the information is the same, the route is saved; otherwise the route is discarded.

 If there are multicast packets in the VPN, the VPN group ID information is allocated to each site when the PEs are configured with the sites in the VPN. Then, the PE device adds the VPN group ID information to the group through the multicast routing protocol. Each site of the group.

 After the above steps, in any way, a routing list is formed for each site on the PE, and the site ID information of each site having a VPN relationship with the site is included in the list.

 Step 320: Configure routing information of the site on each site. The specific implementation process includes the following steps: Step 321: Statically configure routing information between sites;

 Or,

 Step 322: Run a routing protocol between the PE device and the PE device to obtain routing information of other sites that belong to the same VPN as the site.

 The implementation process of step 322 specifically includes:

 First, the local PE device advertises the VPN routing information to the target PE device, where the VPN routing information carries the VPN site ID information of the site set on the local PE device.

 When the target PE receives the VPN routing information, it checks whether there is a site belonging to the same VPN as the site set on the local PE according to the VPN site ID information, and if there is a site belonging to the same VPN, The information of the site is added to the routing information of the site set on the local PE.

 The routing information of the Site includes routing information of the site and all sites having a VPN relationship with the site.

 Step 400: Implement VPN message transmission based on the site routing information set by the foregoing. The specific implementation process is as follows: When forwarding packets between sites within the VPN:

 Since the route to other sites has been obtained at each Site through the above configuration process, a standard single/multicast forwarding mechanism can be adopted. The site forwards the VPN packet to other Site devices in the VPN through the standard unicast/multicast forwarding mechanism. The source/destination addresses carried in the packet are constructed in the VPN internal address format.

 When you need to forward VPN packets through s i t e in the ingress PE device:

Generally, the global VPN address, including the source/destination address, can only be generated by the PE to prevent forged VPN packets. On the inbound backbone network, you need to perform the ingress check on the PE device. That is, the interface that connects the PEs to the local device is configured to receive only the packets with the destination address being the VPN local address and the Internet global address. Address message. At the same time, other interfaces are not allowed to receive packets whose source/destination address is a VPN local address. And the P device does not receive packets whose source/destination address is a VPN local address.

 When the ingress PE device forwards the VPN packet, first, to identify which site the VPN packet belongs to, it is generally identified by the interface/sub-interface method, or according to the IPv6 triplet/IPv4 quintuple/VLAN/ DSCP and other methods are used for identification. After the unicast packet is added, the VPN site ID information is added to the source address structure carried in the packet, and the source address is converted into the source VPN global address. Then, according to the destination address, the s saved on the PE device is searched. The ite routing information, after the site ID information of the destination site is found, the destination address carried in the packet is converted into the destination VPN global address according to the destination site ID information, and then the VPN is globally based on the translated destination. Address, forward the VPN packet to the next hop. For the multicast packet, first add the source VPN site ID, and convert the source address to the source VPN global address. Then add the VPN group ID information to convert the destination address to the destination VPN global multicast address. Then, according to the VPN group ID. The information is searched for the corresponding destination site ID information in the multicast routing information saved on the PE device, and finally the VPN packet is forwarded according to the found destination site ID information. The specific implementation process is as follows:

 When the unicast packet is forwarded by the ingress PE device, it includes:

 Step 411: The ingress PE analyzes the received packet, and obtains a site corresponding to the source address of the packet.

 Step 412: Add the VPN site ID information of the site corresponding to the source address to the packet, and convert the source address into a source VPN global address.

 Step 413: Search for routing information of the destination site according to the destination address carried in the packet, and obtain the destination VPN site ID information.

 Step 414: Convert the destination address carried by the packet to the destination VPN global address according to the obtained destination VPN site ID, and forward the packet to the corresponding site according to the destination VPN site ID information. .

 When the ingress PE device forwards multicast packets, it includes:

 Step 421: The ingress PE analyzes the received packet, and obtains a site corresponding to the source address of the packet.

 Step 422: Convert the source address to the source VPN global address by adding the corresponding VPN site ID information of the s i te;

Step 423: Convert the destination address carried by the packet to the destination VPN by adding the VPN group ID information. Global multicast address;

 Step 424: Search for the multicast routing information saved on the PE device according to the VPN group ID information, obtain the corresponding destination VPN site ID information, and multicast the packet to the corresponding destination according to the destination VPN site ID information. Site.

 When you need to forward VPN packets on the P device:

 For unicast packets, the P device has obtained the aggregated route to the destination site. Therefore, the standard IPv6 route forwarding can be used to reach the egress PE. For multicast packets, you need to search for multicast routing information based on the VPN group ID information in the global multicast address of the VPN. Different from the standard multicast forwarding process, it is forwarded according to the multicast aggregation route according to the longest matching method, also known as multicast aggregation route forwarding. The specific implementation process is as follows:

 When a unicast VPN packet is forwarded through the P device, the following information is included:

 Step 431: When receiving the unicast packet, the P device forwards the packet to the egress PE by using a standard IPv6 routing manner according to the obtained aggregated route of the destination site.

 When a multicast VPN packet is forwarded through the P device, the following information is included:

 Step 432: When receiving the multicast packet, the P device searches for multicast routing information according to the VPN group ID information in the VPN global multicast address carried in the packet, and obtains each of the corresponding multicast groups. Site ID information of the site;

 Step 433: Multicast the multicast packet to each site in the corresponding multicast group according to the obtained site ID information.

 When you need to forward VPN packets through the egress PE device:

 To prevent the misconfiguration or security check on the ingress PE from being invalidated on the egress PE, you should prevent the illegal source site ID from being set on the egress PE. The method is: after the egress PE receives the packet, first extracts the VPN site ID information in the source address in the packet; and then, according to the VPN site ID information, checks that the packet enters the egress PE. If the interface is the interface that obtains the VPN site aggregation route, the packet is forwarded by the egress PE. Otherwise, the packet is discarded.

When forwarding a VPN packet on the egress PE, the unicast packet is first converted into a unicast local address in the VPN, and then the local site is searched according to the site ID information in the translated destination address. Routing information, and forwarding the VPN packet according to the information. For the multicast packet, the source address is translated into the multicast local address of the VPN, and the destination global address is translated into the multicast local address of the VPN according to the VPN group ID information in the destination address. Then according to the multicast locality inside the converted VPN The group ID information in the address forwards the message. The specific implementation process is as follows:

 When forwarding an unicast packet on the egress PE device, it includes:

 Step 451: When the egress PE device receives the unicast packet, the source and destination global addresses of the packet are translated into a unicast local address in the VPN.

 Step 452: Search and obtain local route information of the corresponding site according to the VPN site ID information in the destination global address.

 Step 453: Forward the packet according to the obtained local routing information.

 When the egress packet is forwarded by the egress PE device, it includes:

 Step 454: When the egress PE device receives the multicast packet, the source global address of the packet is translated into a local address in the VPN.

 Step 455: Search and obtain the local routing information of the corresponding site according to the VPN group ID information in the destination address of the packet, and convert the destination global address address into a multicast local address in the VPN according to the obtained local routing information.

 Step 456: Forward the packet according to the group ID information in the multicast local address of the converted VPN. The above process describes the process of accessing each site in the VPN. In addition to accessing other sites in the VPN, the VPN site can also access the Internet.

 When the VPN site accesses the Internet, the VPN site converts the local address of the site in the VPN into an Internet global address according to the VPN site ID information, and accesses the Internet according to the converted Internet global address.

 The format of the internal address translation of the VPN to the Internet global address is as follows:

 I 3 I 45 bits | 16 bits | 64 bits |

I 0011 global routing prefix | subnet ID | interface ID | The above format is RFC3587 standard format, where the global routing prefix can be automatically generated by the VPN site ID.

With the embodiment of the present invention, it can be seen that the standard IPv6 routing and forwarding mode is adopted when forwarding VPN packets. Therefore, when spanning the autonomous system, only the sites in the VPN or the multicast groups in the VPN are required. The routing information is advertised to the neighboring autonomous system, and the routes of the sites in the VPN are distributed between the PE devices belonging to the same VPN network. The embodiment of the present invention can also implement interconnection of IPV4 sites, that is, multiple IPv4s through an IPv6 backbone network. The network is connected to each other or to a VPN user with an IPv4 address. For a unicast packet, the PE device in the VPN still assigns an IPv6 VPN site ID to each IPv4 site. For multicast packets, for each multicast packet, The IPv4 site still assigns a VPN group ID and maintains the IPv4 routing information and saves it to the IPv4 routing information. However, the IPv4 routing information carries a routing attribute, including the VPN site ID to which the IPv4 belongs.

 After the VPN topology is discovered, after the PE device obtains the IPv4 route from the site, the PE site ID attribute is added to other PEs. The destination PE device checks whether the site belongs to the same VPN as the local site. Then save this route, otherwise discard.

 The unicast packet from the CE device to the PE device determines which site it originates from based on the inbound interface, and then searches the IPv4 routing table, determines the destination site, and then translates the source/destination IPv4 address into an IPv6 VPN with embedded IPv4. Unicast address, the format is as follows:

45 bits 32 16 32 bits

 The VPN site ID then finds the next hop for forwarding according to the destination site. After the unicast packet is sent to the P device, the P device searches for the aggregated route of the VPN site according to the address and forwards the packet. When the egress PE is reached, the IPv4 routing table is forwarded to the IPv4 address and the IPv4 routing table is forwarded to the CE.

 The multicast packet that enters the PE from the CE is first determined according to the inbound interface and other information, determines the VPN site, determines the VPN group, and then translates the source address into an IPv6 VPN unicast address embedded with IPv4, and translates the destination address into the embedded address. IPv4 IPv6 VPN multicast address, in the following format:

8 4 4 48 32 32

11111111 | 0101 | 1110 reserved | VPN group ID | IPv4 address Then forwarded in the backbone network according to the VPN group. When the egress PE is reached, it knows that its destination is an IPv4 site, translates it to an IPv4 multicast address, and forwards it to the CE based on the VPN group ID.

As can be seen from the foregoing specific embodiments of the present invention, the embodiment of the present invention utilizes an IPv6 address structure, and can form a VPN address without adding a VPN prefix. The addressing of the local address and the encapsulation of VPN packets in the VPN network are all based on IPv6. The address structure, the route of the site in the VPN network does not need to adopt a special method, and can be implemented by using ordinary IPv6 routes, and does not need to use a special tunnel to encapsulate VPN packets. And there is no need to save inside the VPN backbone. There is also no need to publish routing information for each site within the VPN. Therefore, it has the following significant effects:

1. The IPv6 address is used to accommodate VPN information, and no additional overhead is required for VPN packets.

 2. The forwarding process of the VPN packets and the common IP packets is unified, and the VPN traffic can be carried on the pure IPv6 network.

3. The P device maintains only the VPN site aggregation route, and the overhead is small.

 4. The VPN has a clear relationship. The VPN route only needs to carry a fixed-length site ID for easy processing.

5. According to the difference of the destination address prefix, the site can access the Internet and the VPN at the same time, which is easy to implement;

6. The VPN site prefix is added by the operator PE, and the legitimacy check is performed on the ingress PE, and the RPF check is performed on the egress PE to ensure the security of the VPN.

 7. The IPv4 site does not need to be upgraded to IPv6, and can be interconnected through the IPv6 backbone network to form a VPN.

 8. The method of crossing the autonomous system is simple to implement. There is no need for the autonomous system border router to store/forward VPN routes, and there is no need for a multi-layer label stack.

 In summary, in the embodiment of the present invention, according to the difference of the destination address prefix, each site can access the Internet and the VPN at the same time, thereby facilitating the implementation; when crossing the autonomous system, only the routes of the VPN site and the VPN group are advertised to the adjacent autonomous system. The autonomous system border router does not need to store/forward the VPN route, and the multi-layer label stack is not required, so that the implementation is relatively simple. Moreover, the VPN has a clear relationship, and the VPN route only needs to carry a fixed-length site ID, which is convenient for processing. Moreover, the VPN site prefix is added by the operator PE, and the entry PE performs the legality check, and the egress PE performs the RPF check to ensure the security of the VPN. In addition, the IPv4 site does not need to be upgraded to IPv6, and can be interconnected through the IPv6 backbone network to form a VPN.

 The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives, such as the interconnection between IPv4 sites, are intended to be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

Rights request  A method for implementing a virtual private network, comprising:  Setting a VPN local address and a VPN global address of each site in the virtual private network VPN based on the IPv6 address structure; establishing routing information of each site in the VPN according to the set VPN local address and the VPN global address, and according to the routing information VPN packets are transmitted between sites in the VPN.  The method according to claim 1, wherein the step of establishing routing information of each site in the VPN specifically includes:  According to the set VPN local address and the VPN global address, the routing information of each site in the VPN is configured on the provider edge PE device in the VPN, and the routing information between the associated sites is configured on each site.  The method according to claim 2, wherein the step of configuring the routing information of each site in the VPN on the PE device in the VPN specifically includes:  During initialization, configure the VPN site and the VPN site identifier in the PE device.  When a unicast packet exists in the VPN, the PE device generates an IPv6 aggregation route of each site in the VPN according to the VPN site identifier, and advertises the IPv6 aggregation route to the VPN provider P device and/or the destination PE through a routing protocol. The P device and/or the destination PE compares the VPN identification information in the VPN site identifier included in the IPv6 aggregation route with the VPN identifier in the locally configured VPN site identifier, and if the same, saves the route; , discard the route;  Or,  During initialization, configure a VPN site in the PE device and assign VPN group identification information to it.  When the VPN has a multicast packet, the assigned VPN group identification information is added to each VPN site in the multicast group through the multicast routing protocol.  Or,  During initialization, the PE device of the VPN configures each site in the VPN, and assigns VPN site identification information, ingress route target RT information, and exit RT information to each site.  When a unicast packet exists in the VPN, the PE device generates IPv6 aggregation routing information according to the VPN identification information, the ingress RT information, and the egress RT information, and adds the RT extension group included in the egress RT information to the IPv6 aggregation routing information. Attribute, and then advertised to the P device and/or destination PE of the VPN through a routing protocol; The P device and/or the destination PE compares with the RT extended community attribute information in the locally configured ingress RT information according to the RT extended community attribute information in the VPN route, and if at least one RT extended community attribute information is the same, The route is saved; otherwise, the route is discarded. The method according to claim 2, wherein the step of configuring routing information between the sites associated with each site on the site comprises:  Statically configuring routing information between its associated sites on each VPN site;  Or,  At each VPN site, routing information of a site associated with the site is obtained by running a routing protocol between the PE device and the PE device.  The method according to claim 4, wherein the step of obtaining the routing information of the site associated with the site by running a routing protocol between the PE device and the PE device comprises:  Distributing the VPN routing information to the target PE device by using the site set on the local PE device, where the VPN routing information carries the VPN site identification information of the site;  When receiving the VPN routing information, the target PE checks whether there is a site belonging to the same VPN as the site set on the local PE according to the VPN site information, and if there is a site belonging to the same VPN, the The information of the site is added to the routing information of the site set on the local PE.  The method according to any one of claims 1 to 5, wherein in the step of transmitting a VPN message between the sites in the VPN, the processing inside the VPN includes:  The source address and the destination address of the VPN packet are configured according to the VPN local address of each site in the set VPN. According to the routing information configured on the site, the standard single/multicast forwarding mechanism is used to forward the VPN packet. Forward to the site corresponding to the destination address.  The method according to any one of claims 1 to 5, wherein in the step of transmitting a VPN packet between the sites in the VPN, the processing on the ingress PE device includes:  The ingress PE determines the site corresponding to the source address of the received packet, adds the VPN site identifier information of the site to the packet, and converts the source address into the source VPN global address.  And searching for the routing information of the destination site according to the destination address carried in the packet, obtaining the destination VPN site identifier information, and converting the destination address carried by the packet to the destination VPN global address according to the obtained destination VPN site identifier. Forward the message;  Or,  The ingress PE determines the site corresponding to the source address of the received packet, and adds the source address of the received site to the source VPN global address by adding the VPN site identification information of the site; The destination address of the packet is translated into the destination VPN global multicast address by adding the VPN group identification information, and the multicast routing information saved on the PE device is obtained according to the VPN group identification information to obtain the corresponding destination VPN. The station identifier information is multicast, and the packet is multicast according to the destination VPN site identifier information.  8. The method according to claim 7, wherein the method further comprises:  Configuring the interface that is connected to the VPN site in the ingress PE device to receive only the packet whose destination address is the VPN local address and the Internet global address, and rejects the packet whose destination address is the VPN global address; and, in the P The device is configured to reject packets whose source/destination address is a VPN local address.  The method according to any one of claims 1 to 5, wherein in the step of transmitting a VPN packet between the sites in the VPN, the processing on the P device includes:  When receiving the unicast packet, the P device forwards the packet to the egress PE according to the obtained aggregation route of the destination site in a standard IPv6 routing manner;  Or,  When receiving the multicast packet, the P device determines the site identification information of each site in the multicast group in the multicast routing information according to the VPN group identifier information in the VPN global multicast address carried in the packet; And multicasting the multicast packet according to the foregoing site identifier information.  The method according to any one of claims 1 to 5, wherein in the step of transmitting a VPN packet between the sites in the VPN, the processing on the egress PE device includes:  When the egress PE device receives the unicast packet, the source and destination global addresses of the packet are translated into a unicast local address in the VPN.  Finding and obtaining the local routing information of the corresponding site according to the VPN site identification information in the destination global address, and forwarding the packet according to the obtained local routing information;  Or,  When the egress PE device receives the multicast packet, the source global address of the packet is translated into a local address in the VPN.  Searching for and obtaining the local routing information of the corresponding site according to the VPN group identification information in the destination address carried in the packet, and converting the destination global address address into a multicast local address in the VPN according to the obtained local routing information;  The packet is forwarded according to the VPN group identifier information in the multicast local address of the VPN.  The method according to claim 10, wherein after the egress PE receives the message, the method further includes:  Extracting VPN station identification information in the source address in the packet; Determining, according to the VPN site identifier information, whether the interface that the packet enters the egress PE is a VPN site. The interface that aggregates the route. If yes, the packet is forwarded through the egress PE. Otherwise, the packet is discarded.  The method according to any one of claims 1 to 5, wherein in the step of transmitting a VPN message between the sites in the VPN, the processing of the VPN site accessing the Internet includes:  The VPN site translates the source local address of the site within the VPN into a source global address according to the VPN site identification information, converts the destination local address into an Internet global address, and accesses the Internet according to the Internet global address.  The method according to any one of claims 1 to 5, wherein, in the step of transmitting a VPN packet between the sites in the VPN, the process of forwarding the IPv4 packet through the IPv6 backbone network in the VPN includes:  After receiving the IPv4 unicast packet, the ingress PE searches for the configured IPv4 routing information according to the source IPv4 address information of the packet, obtains the destination IPv4 address information, and converts the source and destination IPv4 addresses into the embedded IPv4 address. An IPv6 unicast address, and then forwarding the IPv4 packet according to the destination address;  After receiving the packet, the P device forwards the packet to the egress PE device according to the IPv6 aggregate routing information. The egress PE device determines the packet according to the IPv4 VPN site identifier information carried in the packet. When the site corresponding to the destination address is an IPv4 site, the IPv4 routing information is searched, the destination IPv6 address is translated into an IPv4 destination address, and the packet is forwarded to the corresponding destination site according to the IPv4 destination address.  Or,  After receiving the IPv4 multicast packet, the ingress PE searches the configured IPv4 routing information according to the source IPv4 address information of the packet, obtains the corresponding destination IPv4 address information, and then converts the source and destination IPv4 addresses into the internal Embedding an IPv4 unicast address of the IPv4 network, and forwarding the IPv4 packet in the IPv6 network according to the destination address;  After the packet reaches the egress PE device, the egress PE device determines, according to the IPv4 VPN group ID information carried in the packet, that the site corresponding to the destination address of the packet is an IPv4 site, and then searches for IPv4 routing information. And converting the destination IPv6 address to an IPv4 destination address, and forwarding the packet to the corresponding destination station according to the IPv4 destination address.  The method according to any one of claims 1 to 5, wherein when the VPN is in the IPv4 site, the method further includes:  Allocating an IPv4 VPN site identifier to the IPv4 site on the PE device, and according to the IPv4 site identifier The IPv4 routing information of each IPv4 site is configured on the PE device. The IPv4 site is assigned IPv4 VPN site identification information on the IPv4 site, and the IPv4 site identification information is respectively configured and associated with each IPv4 site. IPv4 routing information between IPv4 stations;  Or, Assigning an IPv4 VPN group ID to the IPv4 site on the PE device, and using a multicast routing protocol in the PE Adding the VPN group ID information to each VPN site in the multicast group on the device; assigning the IPv4 VPN group ID to the IPv4 site on each IPv4 site, and using the multicast routing protocol on each IPv4 site. The VPN group ID information is added to each VPN site in the multicast group.  15. A device for implementing a virtual private network, comprising:  a routing information establishing unit, configured to establish routing information of each site in the VPN according to a VPN local address and a VPN global address of each site in the VPN, where the VPN local address and the VPN global address of each site in the VPN are IPv6-based addresses Structure setting  The VPN packet transmission processing unit is configured to transmit, according to the routing information established by the routing information, a VPN packet exchanged between sites in the VPN.  The device according to claim 15, wherein the routing information establishing unit comprises: each site routing information establishing unit, configured to be within the VPN according to the set VPN local address and the VPN global address. Configuring routing information of each site in the VPN on the provider edge PE device;  The associated site routing information establishing unit is configured to configure routing information between the associated sites at each site according to the set VPN local address and the VPN global address.  The device according to claim 15 or 16, wherein the VPN packet transmission processing unit specifically includes at least one of the following:  The first VPN internal transmission processing unit is disposed at a site inside the VPN, and configured to construct a source address and a destination address of the VPN packet according to the VPN local address of each site in the set VPN, and establish a unit according to the routing information. The established routing information forwards the VPN packet to the site corresponding to the destination address;  The second VPN packet transmission processing unit is configured to be configured on the ingress PE device, configured to convert the source address of the received packet into a source VPN global address, convert the destination address to the destination VPN global address, and forward the packet;  The third VPN packet transmission processing unit is configured on the P device, and is configured to forward the packet according to the aggregated route of the destination station that obtains the unicast packet, or according to the VPN group identifier information in the multicast packet;  The fourth VPN packet transmission processing unit is configured to be configured on the egress PE device, configured to translate the source and destination global addresses of the packet into a VPN local address in the VPN, and forward the packet according to the local routing information.