WO2018032910A1 - Cross-network communication method and apparatus - Google Patents

Abstract

The present invention relates to the technical field of wireless communications, and provided in the present invention are a cross-network communication method and apparatus, used for solving the existing problem of reduced network security caused by deploying an agent in a virtual machine (VM) and virtualizing an extra network card while implementing communication between different two-layer networks. The method comprises: a routing virtual machine receiving a first vlan data packet sent by a first virtual switch in a first host, encapsulating the first vlan data packet into a first VXLAN data packet, and sending the first VXLAN data packet to a second host, so that the second host sends the first VXLAN packet to a second VM after processing.

Description

Method and device for communicating across networks Technical field

The present invention relates to the field of wireless communication technologies, and in particular, to a method and device for communicating across a network.

Background technique

Heterogeneous cloud network means that two or more private clouds use different access technologies, or private clouds that use the same wireless access technology but belong to different wireless carriers are intelligently integrated through inter-system convergence. Together, a variety of different types of private clouds are provided to provide users with wireless access anytime, anywhere, thereby forming a heterogeneous cloud network.

In a heterogeneous cloud network, if virtual machines (VMs) in different private clouds are in the same Layer 2 network, you can use the same Virtual Local Area Network (VLAN) network to implement inter-network connectivity. Interoperability. However, in practical applications, VMs in different private clouds are usually not in the same Layer 2 network. In this case, the same address space management needs to be implemented by deploying agents in VMs in different private clouds. The management system virtualizes the extra network card through the agent running in the VM, and configures the network card with a unified Internet Protocol (IP) address. The VMs between different private clouds pass each other through the virtual IP address of the same network. Access, and need to rely on overlay network technology (such as: Virtual eXtensible Local Area Network (VXLAN), Generic Routing Encapsulation (GRE), and Virtual Private Network (Virtual Private Network) Encapsulation and decapsulation of technologies such as VPN), and finally achieve network interworking.

It can be seen from the above that in a heterogeneous cloud network, if you want to implement interworking between different Layer 2 networks, you need to customize the VM image in the VM and install the agent in advance, and virtualize the extra network card on the VM. Because the agent is deployed in the VM, it is likely to need to communicate with the outside world. At this time, the VM will face security problems that are attacked by the outside world. In addition, redundant VM cards are added to the VM, and users can use the newly added network card to communicate with the outside world. Bad security control.

Summary of the invention

The present invention provides a method and a device for communicating across a network, so as to solve the problem that the network security of the agent needs to be deployed in the VM and the additional network card is virtualized when the communication between different Layer 2 networks is implemented.

In order to achieve the above object, the present invention adopts the following technical solutions:

In a first aspect, a method for communicating across a network is provided. The method can be applied to communication between a first virtual machine VM and a second VM. The first VM is located at the first host Host, and the second VM is located at the second host. A routing virtual machine is created in a host, and the method may include:

The routing virtual machine receives the first vlan data packet sent by the first virtual switch in the first host, and the first vlan data packet is encapsulated by the Ethernet data packet sent by the first VM, where the first vlan data packet includes: The vlan identifier of the first vlan port corresponding to the VM and the address information of the second VM, and the first vlan data packet is encapsulated into a first VNI including a coverage domain for identifying a layer 2 network where the first VM is located After the VXLAN data packet, sending the first VXLAN data packet to the second Host, so that the second Host is based on the address information of the second VM, And the first VNI, the first VXLAN packet is processed and sent to the second VM.

It should be noted that the routing virtual machine according to the present invention is an element capable of realizing communication across the network based on the description of the present invention, and is merely for convenience of describing the solution provided by the present invention, and does not indicate or imply that the component must be named thereby. In addition, the routing switch may be named as an OVS-vAPP virtual machine, and may also be named as a virtual machine of another name, and thus cannot be construed as limiting the present invention.

In this way, the routing virtual machine intercepts the data packet sent by the VM, encapsulates the data packet sent by the VM into a three-layer VXLAN data packet, and sends the encapsulated VXLAN data packet to the VM in the other private cloud through the three-layer tunnel technology. In this way, the interworking between different Layer 2 networks is realized, and the problem of reducing the security caused by deploying agents in the VM and virtualizing additional network cards is avoided.

Optionally, the routing virtual machine can receive the first vlan packet sent by the first virtual switch by using the following implementation manner:

In an implementation manner of the first aspect, in combination with the first aspect, the second vlan port can be created on the first switch, the second vlan port and the first vlan port have the same vlan identifier, and the second vlan port and the route The second virtual switch in the virtual machine is connected to the first virtual switch that is sent by the first virtual switch in the first host, and the routing virtual machine may include:

The second virtual switch in the routing virtual machine receives the first vlan data packet sent by the first virtual switch through the second vlan port;

The routing virtual machine encapsulating the first vlan data packet into the first VXLAN data packet may include:

The second virtual switch in the routing virtual machine encapsulates the first vlan data packet into the first VXLAN data packet.

In a further implementation manner of the first aspect, in combination with the first aspect, a trunk trunk port may be created on the first switch, the routing virtual machine includes a second virtual switch, and the third virtual switch has a third vlan port. The trunk port is connected to the third vlan port, and the third vlan port has the same vlan identifier as the first vlan port; the routing virtual machine receives the first vlan data packet sent by the first virtual switch in the first host, including:

The routing virtual machine receives the first vlan data packet sent by the first virtual switch in the first host through the trunk port;

The routing virtual machine sends the first vlan data packet to the second virtual switch by using the vlan identifier in the first vlan data packet through the third vlan port corresponding to the vlan identifier.

The routing virtual machine encapsulates the first vlan data packet into the first VXLAN data packet, including:

The second virtual switch in the routing virtual machine encapsulates the first vlan data packet into the first VXLAN data packet.

In this way, the routing virtual machine can intercept the traffic sent by the VM in the Host for subsequent processing and send it to the peer VM.

In a further implementation manner of the first aspect, in combination with the first aspect or any implementation manner of the first aspect, the first Host may be located in the first private cloud, and the second Host may be located in the second private cloud, the first The private cloud includes a first Layer 2 gateway, and the second private cloud includes a second Layer 2 gateway; the routing virtual machine sending the first VXLAN packet to the second Host may include:

The routing virtual machine sends the first VXLAN data packet to the first layer 2 gateway, and the first layer 2 gateway receives the first VNI in the first VXLAN data packet according to the preset correspondence between the first VNI and the second VNI. Modifying to the second VNI, and passing the first VXLAN packet including the second VNI through the first Layer 2 gateway and the second Layer 2 gateway The VXLAN tunnel is sent to the second layer 2 gateway, and the second layer 2 gateway changes the second VNI in the received first VXLAN packet to the first according to the preset correspondence between the first VNI and the second VNI. VNI, and sends the first VXLAN data packet to the second Host according to the first VNI.

In this way, the VXLAN packet encapsulated by the routing virtual machine can be sent to the Layer 2 gateway in the other private cloud through the tunnel technology through the Layer 2 gateway in the private cloud, and processed by the Layer 2 gateway in the other private cloud, and then sent to the Layer 2 gateway in the other private cloud. The VM inside the Host.

In addition, in order to reduce the deployment cost, in another feasible solution of the present invention, the OVS-vApp virtual machine may be added only in one Host, and all VMs in any other Host may be implemented by the OVS-vApp virtual machine. The communication between itself and other VMs, that is, in another implementation manner of the first aspect, in combination with the first aspect or any one of the first aspects, the present invention can also implement the third method by the following method. Communication between the VM and the second VM, the third VM is located in the third host, the first Host and the third Host are located in the first private cloud, the first private cloud further includes: a physical switch, and the OVS-vApp is not deployed in the third Host virtual machine:

The routing virtual machine receives the third vlan data packet sent by the physical switch and sent by the virtual switch in the third host to the physical switch, and the third vlan data packet is encapsulated by the Ethernet data packet sent by the third VM, and the Ethernet data packet is formed. For the data packet sent to the second VM, the third vlan data packet includes: a vlan identifier of the fourth vlan port corresponding to the third VM, and address information of the second VM, and the routing virtual machine encapsulates the third vlan data packet into a second VXLAN packet, and sending a second VXLAN packet to the second host, so that the second Host processes the second VXLAN packet and sends the packet to the second VM according to the address information of the second VM and the second VNI. The second VNI is used to identify the coverage area of the Layer 2 network where the third VM is located.

In this way, if the routing virtual machine is not deployed in the host, the data packet sent by the VM in the host is encapsulated in the VXLAN by the routing virtual machine in the other host, and the encapsulated VXLAN data packet is sent by the routing virtual machine to the routing virtual machine. Host where the peer VM is located.

A second aspect provides a routing virtual machine, including a sending unit, a packaging unit, and a receiving unit;

a receiving unit, configured to receive a first vlan data packet sent by the first virtual switch in the first host;

a packaging unit, configured to encapsulate the first vlan data packet received by the receiving unit into a first VXLAN data packet;

The sending unit is further configured to send, to the second host, the first VXLAN data package encapsulated by the unit.

The specific implementation manner of the second aspect may refer to the behavior of the virtual machine in the cross-network communication method provided by the first aspect or the possible implementation manner of the first aspect. Therefore, the routing virtual machine provided by the second aspect may reach The same benefits as the first aspect.

In a third aspect, a route virtual machine is provided, including a processor and a transceiver;

a transceiver, configured to receive a first vlan data packet sent by the first virtual switch in the first host;

a processor, configured to encapsulate the first vlan data packet received by the transceiver into a first VXLAN data packet;

The processor is further configured to send the first VXLAN data package after the processor is encapsulated to the second host.

The specific implementation manner of the third aspect may refer to the behavior of the virtual machine in the method for cross-network communication provided by the first aspect or the possible implementation manner of the first aspect. Therefore, the routing virtual machine provided by the third aspect may reach The same benefits as the first aspect.

In a fourth aspect, a non-transitory computer readable storage medium storing one or more programs, the instructions comprising instructions, when included in the second aspect or the third aspect or any of the above, Implementation When the routing virtual machine executes, the routing virtual machine performs the following events:

Receiving a first vlan data packet sent by the first virtual switch in the first host, encapsulating the first vlan data packet into a first VXLAN data packet, and sending the first VXLAN data packet to the second host, so that the second host device The first VXLAN packet is processed and sent to the second VM.

The specific implementation manner of the fourth aspect may refer to the behavior of the virtual machine in the cross-network communication method provided by the first aspect or the possible implementation manner of the first aspect. Therefore, the routing virtual machine provided by the fourth aspect may reach The same benefits as the first aspect.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a schematic diagram of an architecture of a heterogeneous cloud network;

2 is a schematic structural diagram of a heterogeneous cloud network according to an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a physical host according to an embodiment of the present disclosure;

FIG. 4 is a flowchart of a method for communicating across a network according to an embodiment of the present invention;

FIG. 5 is a structural diagram of a host machine according to an embodiment of the present invention; FIG.

FIG. 5B is a structural diagram of still another host machine according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic diagram of a process of communicating across a network according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of a process of communicating across a network according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of an OVS-vAPP virtual machine according to an embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram of an OVS-vAPP virtual machine according to an embodiment of the present invention.

detailed description

The principle of the present invention is: adding a routing virtual machine in the host where the VM is located, the routing virtual machine intercepts the data packet sent by the VM, encapsulates the data packet sent by the VM into a VXLAN data packet, and encapsulates the VXLAN packet. The data packets are sent to the VMs in other private clouds through the overlay network technology, so as to achieve interworking between different Layer 2 networks, avoiding the deployment of agents in the VM and virtualizing additional network cards.

It should be noted that the routing virtual machine according to the present invention is an element capable of realizing communication across the network based on the description of the present invention, and is merely for convenience of describing the solution provided by the present invention, and does not indicate or imply that the component must be named thereby. Therefore, the limitation of the present invention is not limited. For example, the routing switch may be named as an OVS-vAPP virtual machine, and may also be named as a virtual machine of another name. Optionally, in the following embodiments of the present invention, the newly added “routing virtual machine” may be named “OVS-vAPP virtual machine” to describe the method and device for heterogeneous cloud network communication provided by the present invention.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

It should be noted that the term "and/or" in this document is merely an association relationship describing the associated object, indicating There may be three relationships, for example, A and/or B, which may indicate that there are three cases where A exists separately, and A and B exist simultaneously, and B exists separately. In addition, the character "/" in this article generally indicates that the contextual object is an "or" relationship.

The method for cross-network communication according to the present invention can be applied to a heterogeneous cloud network to implement communication between VMs in different Layer 2 networks in a heterogeneous cloud network. For the convenience of description, the embodiment of the present invention uses only the heterogeneous cloud network shown in FIG. 1 as an example to describe the method and device for heterogeneous cloud network communication provided by the present invention. The VMs in different Layer 2 networks refer to: A VM that is in a different virtual local area network. The Layer 2 network can be a Layer 2 virtual network or a Layer 2 physical network.

As shown in FIG. 1, the heterogeneous cloud network may include: a cloud manager, and at least one private cloud. The cloud management system is composed of multiple servers, and is mainly used for uniformly managing resources (such as computing, network, and storage resources) in a private cloud in a heterogeneous cloud network, and can use IP addresses in the same subnet in different private groups. VMs are deployed on the cloud, that is, VMs in different private clouds are assigned IP addresses in the same subnet. Different private clouds can be in the same Layer 2 network or not in the same Layer 2 network. The same private cloud (referred to as: Cloud) can include Network Server, Layer 2 Gateway (L2G), and Virtual Switch. (vSwitch), and multiple hosts (Host); a dynamic host configuration protocol (DCHP) server can be deployed inside the network server, and the DCHP server can be used to store the IP address of each VM; the L2GW is mainly used. The L2GW in other private clouds can communicate with each other through the overlay network technology. The vSwitch is used to implement data transmission between hosts. Different vlan ports can be deployed in the private network. The vlan ports can be used to isolate packets sent by different VMs through the vlan port. The vSwitch and Host can run on the hardware layer of the physical host (not shown in Figure 1) in the private cloud. Each Host can contain multiple VMs. It should be noted that FIG. 1 is only a schematic diagram, and the private cloud, the host machine, and the VM shown in FIG. 1 are only examples, and the number thereof does not limit the solution of the present invention. In actual deployment, the heterogeneous cloud network can be deployed. Different from the multiple components shown in Figure 1.

At this time, if the communication between the VM in the private cloud 1 and the VM in the private cloud 2 in FIG. 1 is to be realized, the existing technician needs to deploy the agent and virtualize the extra network card in the VM, but this will reduce the network. Security, in order to solve the problem, as shown in FIG. 2, the present invention adds an OVS-vAPP virtual machine to the host of the private cloud, and the VSwitch (ovs) can also be deployed in the OVS-vAPP virtual machine. After the VM in the host accesses the vlan port on the vSwitch in the host, a vlan port with the same function as the vlan port can be created on the OVS-vAPP virtual machine, and the vlan created in the OVS-vAPP virtual machine will be created. The port is added to the ovs, so that the traffic sent by the VM passes through the vSwitch in the host, and then flows into the ovs in the OVS-vAPP virtual machine, and all traffic sent by the VM is intercepted by the OVS-vAPP virtual machine, and OVS-vAPP is used. After the virtual machine processes the intercepted traffic (for example, encapsulated into a VXLAN packet), it is sent to the VMs in other private clouds through the tunnel between the private clouds to implement VM interworking between different networks.

It should be noted that, in order to distinguish the virtual switch in the Host from the virtual switch other than the OVS-vAPP virtual machine and the virtual switch in the OVS-vAPP virtual machine, in the solution of the present invention, it will be independent of the OVS-vAPP. The virtual switch outside the virtual machine is called: vSwitch, and the virtual switch in the OVS-vAPP virtual machine is called: ovs.

The hardware environment in which the OVS-vAPP virtual machine runs is described in detail below with reference to Figure 3:

As shown in FIG. 3, the OVS-vAPP virtual machine 1041 runs on the Host 104, which runs on the hardware layer of the physical host 10, and the hardware layer may include a Remote Direct Memory Access (RDMA) network card 103. Optionally, as shown in FIG. 3, the hardware layer may further include at least one processor 102 and a memory 101, and the devices are connected and communicated with each other through a communication bus or a direct connection. The Host 104 may further include a plurality of VMs 1042 and vSwitch 1043 in addition to the OVS-vAPP virtual machine 1041.

Host104 is used as the management layer to manage and allocate hardware resources, and presents a virtual hardware platform for the internal virtual machine. The virtual hardware platform runs on each virtual machine (such as: OVS-vAPP virtual machine 1041, VM1042). And vSwitch1043) provides various hardware resources, such as providing virtual processors (VCPUs), virtual memory, virtual disks, virtual network cards, and so on.

The OVS-vAPP virtual machine 1041, VM1042, and vSwitch 1043 work like a real computer. The OVS-vAPP virtual machine 1041, VM 1042, and vSwitch 1043 can be installed with operating systems and applications, the OVS-vAPP virtual machine 1041, VM 1042, and The vSwitch1043 also has access to network resources.

The RDMA network card 103 in the hardware layer may be various network cards supporting the RDMA function, for example, an InfiniBand card or an RDMA over Converged Ethernet (RoCE) card.

The processor 102 can be a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention.

Memory 101 can include random access memory and provides instructions and data to processor 102.

For convenience of description, the following embodiments show and describe in detail the process of cross-network communication provided by the present invention in the form of steps, wherein the steps shown may be performed in addition to being executed in the OVS-vAPP virtual machine. Executed in a computer system that executes instructions. Moreover, although logical sequences are shown in the figures, in some cases the steps shown or described may be performed in a different order than the ones described herein.

Embodiment 1

FIG. 4 is a flowchart of a method for communicating across a network according to an embodiment of the present invention, which may be executed by the OVS-vAPP virtual machine shown in FIG. 2 and FIG. 3, for implementing communication between a first VM and a second VM. The first VM is located in the first Host, the second VM is located in the second Host, and the OVS-vAPP virtual machine is located in the first Host. As shown in FIG. 4, the method may include the following steps:

S101: The OVS-vAPP virtual machine receives the first vlan data packet sent by the first virtual switch in the first host, where the first vlan data packet is encapsulated by an Ethernet data packet sent by the first VM, and the Ethernet data packet is encapsulated. For the data packet sent to the second VM, the first vlan data packet includes: a vlan identifier of the first vlan port corresponding to the first VM, and address information of the second VM.

The first VM may be any VM in the first Host, and the Ethernet data packet sent by the first VM may include, but is not limited to, the following types of data packets: media access control for requesting acquisition of the first VM (Media) An Address Resolution Protocol (ARP) of an Access Control (MAC) address, a data packet for requesting acquisition of an IP address of a first VM, and a data packet for requesting service data.

The vlan identifier is used to identify the first vlan port, and the first vlan port can be deployed on the first virtual switch and connected to the first VM.

The address information of the second VM may be the IP address of the second VM or the MAC address of the second VM.

Optionally, after the first VM is started, the first VM may send the Ethernet packet sent by itself to the first virtual switch by using the first vlan port connected to the first VM, where the first virtual switch is from the first vlan. After receiving the Ethernet data packet, the port generates the first vlan data packet by encapsulating the Ethernet data packet with the vlan identifier of the first vlan port according to the vlan identifier of the first vlan port, for example, the head of the Ethernet data packet. Add the vlan ID of the first vlan port. It should be noted that, in the process of generating the first vlan data packet, including but not limited to adding the vlan identifier only on the Ethernet data packet, in addition, you can add: Layer Ethernet header, inner IP header, and other payloads.

Optionally, after the first virtual switch generates the first vlan data packet, the OVS-vAPP virtual machine can receive the first vlan data packet sent by the first virtual switch in the following two manners:

Manner 1: The second vlan port is created on the first switch, the second vlan port has the same vlan identifier as the first vlan port, and the second vlan port is connected to the second virtual switch in the OVS-vAPP virtual machine.

The first virtual switch may search for the first vlan port after the first vlan port corresponding to the first vlan identifier according to the first vlan identifier in the encapsulated first vlan data packet, and the encapsulated first vlan data packet. Sended through the second vlan port;

The second virtual switch in the OVS-vAPP virtual machine can receive the first vlan packet sent by the first virtual switch from the second vlan port.

The second vlan port and the first vlan port have the same vlan identifier, and the second vlan port and the first vlan port have the same function, and the second vlan port supports transmitting the data packet sent from the first vlan port. It should be noted that, in actual deployment, the first vlan port and the second vlan port may be named by the same name, or may be named by different names, which is not limited by the embodiment of the present invention.

For example, as shown in FIG. 5A, two virtual machines are included in Host1: VM1 and VM2, VM1 is connected to vlan1 port on vSwtich1, and VM2 is connected to vlan2 port on vSwtich1. At this time, vlan1 can be added to vSwtich1. A port with the same function as the vlan port and the vlan port with the same function as the vlan2 port, and the vlan port with the same function as the vlan1 port and the vlan port with the same function as the vlan2 port are connected to the ovs (as shown in the virtual box in Figure 5A). So, after receiving the Ethernet packet sent by VM1 through the vlan1 port, vSwtich1 encapsulates the Ethernet packet into a vlan packet and sends it to the ovs through the vlan port in the virtual box that has the same function as the vlan1 port. .

Manner 2: Create a trunk port on the first switch, create a third vlan port on the second virtual switch in the OVS-vAPP virtual machine, connect the trunk port to the third vlan port, and connect the third vlan port with The first vlan port has the same vlan identifier;

The first virtual switch can send the encapsulated first vlan packet through the trunk port;

The OVS-vAPP virtual machine can receive the first vlan data packet sent from the trunk port, according to the first vlan identifier in the first vlan data packet, and pass the first vlan data packet to the third vlan port with the first vlan identifier. Send to the second virtual switch in the OVS-vAPP virtual machine.

Therefore, in actual deployment, it is not necessary to mount a port with the same function as the vlan port connected to the VM on the vSwtich in the host every time the VM is created, but to create a trunk port on the vSwtich from the beginning. And the corresponding vlan port is planned, and the vlan port corresponding to the trunk port is created in ovs. Subsequently, when a new VM is created in the host, the vlan port connected to the new VM needs to be created on the ovs. You can connect the newly created vlan port to the trunk port to reduce the number of vlan ports created on vSwtich in the host and reduce the load of vSwtich.

The third vlan port and the first vlan port have the same vlan identifier, and the third vlan port and the first vlan port have the same function, and the third vlan port supports transmitting the data packet sent from the first vlan port. It should be noted that, in actual deployment, the first vlan port and the third vlan port may be named by the same name, or may be named by different names, which is not limited in this embodiment of the present invention.

For example, as shown in FIG. 5B, two virtual machines are included in Host1: VM1, VM2, VM1 and vSwtich1. On the vlan1 port, the VM2 is connected to the vlan2 port on the vSwtich1, and the trunk port is created on the vSwtich1. The vlan port with the same function as the vlan1 port and the vlan port with the same function as the vlan2 port are created on the ovs (as shown in Figure 5B). As shown in the box, the trunk port is connected to the vlan port on the ovs. Thus, the vSwtich1 can encapsulate the Ethernet packet into the first vlan packet after receiving the Ethernet packet sent by the VM1 through the vlan1 port. The OVS-vAPP virtual machine receives the first vlan data packet through the trunk port in the virtual box, and sends the first vlan data packet according to the vlan identifier in the first vlan data packet, and sends the vlan with the same function as the vlan1 port. To ovs.

S102: The OVS-vAPP virtual machine encapsulates the first vlan data packet into the first VXLAN data packet, and sends the first VXLAN data packet to the second host, so that the second host sends the first VXLAN data packet to the first The second VM, wherein the first VXLAN data packet includes: a first virtual extended local area network identifier VNI.

The VXLAN Network Identifier (VNI) is used to identify a coverage area (also referred to as a VXLAN segment) of the Layer 2 network where the first VM is located.

Optionally, the OVS-vAPP virtual machine encapsulates the first vlan data packet into the first VXLAN data packet, which may include:

The vlan identifier in the first vlan packet is removed, and the first VNI is encapsulated. It should be noted that, in the process of being encapsulated into the first VXLAN data packet, including but not limited to only encapsulating the VNI, in addition, the original Ethernet data packet with the vlan identifier removed may be encapsulated: outer layer Ethernet header, outer IP header, User Datagram Protocol (UDP) header, VXLAN tag, and some reserved fields.

In this way, the Layer 2 Ethernet data packet can be encapsulated by the Layer 3 protocol to implement the extension of the Layer 2 network in the Layer 3 network, and the VMs in different Layer 2 networks can communicate through the Layer 3 interworking technology.

Optionally, when the cross-network communication is performed in the heterogeneous cloud network, the first host may be located in the first private cloud, the second host may be located in the second private cloud, and the first private cloud may include the first second-layer gateway. The second private cloud may include a second layer 2 gateway. Correspondingly, the OVS-vAPP virtual machine sends the first VXLAN data packet to the second host, which may include:

The OVS-vAPP virtual machine sends the first VXLAN data packet to the first layer 2 gateway;

The first layer 2 gateway modifies the first VNI in the received first VXLAN data packet to the second VNI according to the preset correspondence between the first VNI and the second VNI, and the first VXLAN including the second VNI The data packet is sent to the second layer 2 gateway through the VXLAN tunnel between the first layer 2 gateway and the second layer 2 gateway.

The second layer 2 gateway modifies the received second VNI in the first VXLAN data packet to the first VNI according to the preset correspondence between the first VNI and the second VNI, and the first VXLAN according to the first VNI The data packet is sent to the vSwitch in the second host where the second VM is located;

After receiving the first VXLAN data packet, the vSwitch in the second Host converts the first VXLAN data packet into the second vlan data packet according to the address information of the second VM in the first VXLAN data packet, and removes the second vlan identifier. The vlan port corresponding to the vlan identifier is sent to the second VM, where the second vlan data includes the second vlan identifier, and the second vlan identifier is used to identify the vlan port connected to the second VM.

The cloud management system in the heterogeneous cloud network may pre-configure the VNIs of the first VM and the second VM in different networks, configure the VNIs of the two as the first VNI, and pre-configure the first VNI and the second VNI. Corresponding relationship, so that the first layer 2 gateway and the second layer 2 gateway can obtain the correspondence between the first VNI and the second VNI from the cloud management system, and perform VNI modification according to the correspondence between the first VNI and the second VNI, Two VNI can Any VNI configured for the first Layer 2 gateway for the cloud management system. Optionally, the cloud management system can configure at least one VNI for the first Layer 2 gateway.

For example, VM1 is in private cloud 1, VM2 is in private cloud 2, L2GW1 in private cloud 1 and L2GW2 in private cloud 2 are interoperable through VXLAN tunnel technology, VM1 and VM2 have VNIs of 5000, and cloud management system is VNI configured for L2GW1. The range is 7000 ~ 8999. When VM1 and VM2 communicate, the cloud management system can select unused VNIs from 7000 to 8999, such as 7000, to map VMNIs to VM1 and VM2, and map them. It is delivered to L2GW1 and L2GW2. In this way, when L2GW1 receives the VXLAN packet containing 5000, the 5000 is modified to 7000, and then sent to L2GW2. After receiving the VXLAN packet containing 7000, L2GW2 sends the 7000 modified 5000 to The vSwitch in the Host.

In order to make the purpose, technical solution and advantages of the present invention clearer, the communication process of VM1 acquiring the MAC address of VM2 is described in detail below with reference to FIG. 6, VM1 is in vlan1 in private cloud 1, and VM2 is in vlan2 in private cloud 2. Vlan1 and vlan2 are different virtual local area networks, where the IP addresses of VM1 and VM2 are 10.0.0.100 and 10.0.0.101, respectively:

1VM1 finds that the IP address (10.0.0.101) of VM2 to be accessed is in the same network, and sends an ARP packet for obtaining the MAC address corresponding to 10.0.0.101 to vSwitch1 through vlan1. The ARP packet contains : The IP address of VM2; after receiving the packet, vSwitch1 adds the identifier of vlan1 to the vlan packet. After that, vSwitch1 sends the vlan packet to the same vlan1 port as vlan1. At this time, the vlan packet enters the ovs in the OVS-vApp virtual switch. After receiving the vlan packet, ovs first removes the vlan identifier and corresponds to VM1. VNI, the vlan packet is converted to a VXLAN packet and forwarded to the L2GW1 in the private cloud 1 through the public port vlan0 of the vSwitch1.

2 L2GW1 in the private cloud 1 modifies the VNI in the received VXLAN packet, and the modified VXLAN packet arrives at the L2GW2 in the private cloud 2 through the VXLAN.

3 The L2GW2 in the private cloud 2 modifies the VNI in the received VXLAN packet to the VNI of the VM2, and sends the modified VXLAN packet to the vSwitch2 in the Host2 where the VM2 is located according to the VNI of the VM2, after which the vSwitch2 is based on VM2's IP address, remove the VNI in the received VXLAN packet, convert the vlan2 ID corresponding to VM2 into a vlan packet, and then remove the vlan flag to become an ARP packet and enter VM2 through vlan2. VM2 receives the After the ARP packet, it will directly reply to VM1 with its own MAC address.

It can be understood that the foregoing describes only the communication between the VM in one Host and the VM in the other Host. If the VM of any other Host needs to communicate with the VM in the other Host, the The OVS-vApp virtual machine is added to the host, and the VMs are interoperable through the above methods. That is, the OVS-vApp virtual machine can be added to each Host, and the VM and other VMs in the Host can be realized by the OVS-vApp virtual machine. Communication between VMs in the Host.

However, in order to reduce the deployment cost, in another feasible solution of the present invention, the OVS-vApp virtual machine may be added only in one Host, and all VMs in any other Host may be implemented by the OVS-vApp virtual machine. The communication between the third VM and the second VM is implemented in the embodiment of the present invention. The third VM is located in the third host, and the third host is located in the first private cloud. A private cloud further includes: a physical switch, and the OVS-vApp virtual machine is not deployed in the third host;

The OVS-vAPP virtual machine receives the third vlan sent by the physical switch through the virtual switch in the first Host. a data packet, the third vlan data packet is sent by the virtual switch in the third host to the physical switch, and the third vlan data packet is encapsulated by an Ethernet data packet sent by the third VM, and the Ethernet data packet is sent. a data packet to the second VM, the third vlan data packet includes: a vlan identifier of the fourth vlan port corresponding to the third VM, and address information of the second VM;

The OVS-vAPP virtual machine encapsulates the third vlan data packet into a second VXLAN data packet, and sends a second VXLAN data packet to the second host, so that the second host sends the second VXLAN data packet to the second VM. The second VXLAN data packet includes: a second virtual VNI, where the second VNI is used to identify a coverage area of the Layer 2 network where the third VM is located.

Optionally, the physical switch can be configured with a first trunk port corresponding to the third host and a second trunk port corresponding to the first host, and the virtual switch in the third host can use the trunk port to send the third vlan packet. Sending to the physical switch, the physical switch can send the third vlan packet to the vSwitch in the first host through the second trunk port, and the vlan receives the received third vlan packet to the OVS-vAPP virtual machine, where OVS A vlan port with the same function as the vlan port connected to the third VM is created on the -vAPP virtual machine.

The process of sending the second VXLAN data packet to the second host by the OVS-vAPP virtual machine is the same as the process of sending the first VXLAN data packet to the second host by the OVS-vAPP virtual machine, and details are not described herein again.

In order to make the purpose, technical solution and advantages of the present invention clearer, the communication process of acquiring the MAC address of VM2 by VM3 is described in detail below with reference to FIG. 7, VM3 is in vlan3 in private cloud 1, and VM2 is in vlan2 in private cloud 2. Vlan3 and vlan2 are different virtual local area networks, wherein the IP addresses of VM3 and VM2 are 10.0.0.102 and 10.0.0.101, respectively:

1VM3 finds that the IP address (10.0.0.101) of VM2 to be accessed is in the same network, and sends an ARP packet for obtaining the MAC address corresponding to 10.0.0.101 to vSwitch3 through vlan3. The ARP packet contains : The IP address of VM2; after receiving the packet, vSwitch3 adds the identifier of vlan3 to the vlan packet. After that, vSwitch3 sends the vlan packet to the physical switch through the trunk2 port. The physical switch sends the received vlan packet to vSwitch1 in Host1 through the trunk1 port. vSwitch1 sends the vlan packet through the same vlan port as vlan1. When the vlan packet enters the ovs in the OVS-vApp virtual switch, the ovs first removes the vlan identifier after receiving the vlan packet, and puts the VNI corresponding to the VM3, and converts the vlan packet into a VXLAN packet through the public port of the vSwitch1. Vlan0 is forwarded to L2GW1 in private cloud 1.

2 L2GW1 in the private cloud 1 modifies the VNI in the received VXLAN packet, and the modified VXLAN packet arrives at the L2GW2 in the private cloud 2 through the VXLAN.

3 The L2GW2 in the private cloud 2 modifies the VNI in the received VXLAN packet to the VNI of the VM2, and sends the modified VXLAN packet to the vSwitch2 in the Host2 where the VM2 is located according to the VNI of the VM2, after which the vSwitch2 is based on VM2's IP address, remove the VNI in the received VXLAN packet, convert the vlan2 ID corresponding to VM2 into a vlan packet, and then remove the vlan flag and change the ARP packet to vm2 through vlan2. vm2 receives the IP address. After the ARP packet, it will directly reply to VM3 with its own MAC address.

As can be seen from the above, the embodiment of the present invention provides a method for communicating across a network. The OVS-vAPP virtual machine receives the first vlan data packet sent by the first virtual switch in the first host, and encapsulates the first vlan data packet into the first packet. VXLAN And transmitting the first VXLAN data packet to the second host, so that the second host processes the first VXLAN data packet and sends the data to the second VM. In this way, the communication between the VMs is realized by the OVS-vAPP virtual machine, and there is no need to deploy the agent in the VM and virtualize the additional network card, thereby avoiding the need to deploy the agent in the VM when implementing communication between different Layer 2 networks. And the problem of reduced network security caused by virtualizing additional network cards.

The above-mentioned scheme for cross-network communication provided by the embodiment of the present invention is mainly introduced from the perspective of the OVS-vAPP virtual machine. It can be understood that the OVS-vAPP virtual machine includes corresponding hardware structures and/or software modules for performing various functions in order to implement the above functions. Those skilled in the art will readily appreciate that the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

The embodiment of the present invention may divide the function module of the OVS-vAPP virtual machine according to the foregoing method example. For example, each function module may be divided according to each function, or two or more functions may be integrated into one processor. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.

FIG. 8 is a schematic diagram showing a possible structure of the OVS-vAPP virtual machine involved in the foregoing embodiment. As shown in FIG. 8, the OVS-vAPP virtual machine is shown in FIG. 20 may include a receiving unit 201, a packaging unit 202, and a transmitting unit 203. The receiving unit 201 is configured to support the OVS-vAPP virtual machine to execute the process S101 in FIG. 4, and the encapsulating unit 202 and the sending unit 203 are used to jointly support the OVS-vAPP virtual machine to execute the process S102 in FIG. 4. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional descriptions of the corresponding functional modules, and details are not described herein again.

In the case of employing an integrated unit, FIG. 9 shows a possible structural diagram of the OVS-vAPP virtual machine involved in the above embodiment. The OVS-vAPP virtual machine 300 includes a processor 3011, a memory 3012, a transceiver 3013, and a communication bus 3014. The processor 3011, the memory 3012, and the transceiver 3013 are connected to each other through a communication bus 3014. The communication bus 3014 may be a peripheral component interconnection. A Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, and the like.

The processor 3011 may be a processor or a controller, and may be, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application specific integrated circuit (Application-Specific). Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc., for controlling and managing the actions of the OVS-vAPP virtual machine, for example, The processor 3011 is configured to support the encapsulation process in S102 in FIG. 4,

The transceiver 3013 may be a transceiver circuit or a communication interface or the like for performing the process S101 in FIG. 4 and the transmitting process in the process S102 in FIG.

It will be apparent to those skilled in the art that, for the convenience and brevity of the description, the system described above, For a specific working process of the device and the unit, refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present invention, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some port, device or unit, and may be electrical or otherwise.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network devices. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each functional unit may exist independently, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

The above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium. The software functional units described above are stored in a storage medium and include instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform portions of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: Universal Serial Bus (USB) flash drive (English: USB flash drive), mobile hard disk, read-only memory (English: read-only memory, ROM), random access A medium that can store program code, such as a random access memory (RAM), a magnetic disk, or an optical disk.

It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not limited thereto; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that Modifications to the technical solutions described in the foregoing embodiments, or equivalents to some of the technical features, are not included in the scope of the claims.

Claims (15)

A method for communicating across a network, the method being applied to communication between a first virtual machine VM and a second VM, wherein the first VM is located at a first host Host, and the second VM is located at a second Host, wherein a routing virtual machine is created in the first host, and the method includes: The routing virtual machine receives a first virtual local area network vlan data packet sent by the first virtual switch in the first host, where the first vlan data packet is encapsulated by an Ethernet data packet sent by the first VM. The first vlan data packet includes: a vlan identifier of the first vlan port corresponding to the first VM, and address information of the second VM; The routing virtual machine encapsulates the first vlan data packet into a first virtual extended local area network VXLAN data packet, and sends the first VXLAN data packet to the second host, so that the second host is according to the first Address information of the second VM and the first virtual extended local area network identifier VNI, which are processed and sent to the second VM, where the first VXLAN data packet includes the first VNI, the first A VNI is used to identify the coverage area of the Layer 2 network where the first VM is located. The method of claim 1, wherein the second switch creates a second vlan port, the second vlan port has the same vlan identifier as the first vlan port, and the second vlan The port is connected to the second virtual switch in the routing virtual machine; the routing virtual machine receives the first vlan data packet sent by the first virtual switch in the first host, including: The second virtual switch in the routing virtual machine receives the first vlan data packet sent by the first virtual switch by using the second vlan port; The routing virtual machine encapsulates the first vlan data packet into a first VXLAN data packet, including: The second virtual switch in the routing virtual machine encapsulates the first vlan data packet into a first VXLAN data packet. The method according to claim 1, wherein a trunk port is created on the first switch, the route virtual machine includes a second virtual switch, and a third vlan port is created on the second virtual switch. The trunk port is connected to the third vlan port, and the third vlan port has the same vlan identifier as the first vlan port; the routing virtual machine receives the first virtual switch in the first host to send The first vlan packet includes: The routing virtual machine receives a first vlan data packet sent by the first virtual switch in the first host through the trunk port; Sending, by the routing virtual machine, the first vlan data packet to the second virtual switch by using a third vlan port corresponding to the vlan identifier according to the vlan identifier in the first vlan data packet; The routing virtual machine encapsulates the first vlan data packet into a first VXLAN data packet, including: The second virtual switch in the routing virtual machine encapsulates the first vlan data packet into a first VXLAN data packet. The method according to any one of claims 1-3, wherein the first Host is located in a first private cloud, the second Host is located in a second private cloud, and the first private cloud includes a first second a layer gateway, the second private cloud includes a second layer 2 gateway, and the routing virtual machine sends the first VXLAN data packet to the second host, including: Transmitting, by the routing virtual machine, the first VXLAN data packet to the first Layer 2 gateway, so that the first layer 2 The gateway modifies the received first VNI in the first VXLAN data packet to the second VNI according to a preset correspondence between the first VNI and the second VNI, and includes the foregoing The first VXLAN packet of the second VNI is sent to the second Layer 2 gateway through a VXLAN tunnel between the first Layer 2 gateway and the second Layer 2 gateway, and the second Layer 2 gateway is configured according to the Corresponding relationship between the first VNI and the second VNI, modifying the received second VNI in the first VXLAN data packet to the first VNI, and according to the first VNI A VXLAN packet is sent to the second Host. The method according to any one of claims 1-3, wherein the method is further configured to implement communication between a third VM and the second VM, where the third VM is located at a third Host, The first host is connected to the third host and is connected to the same physical switch, and the routing virtual machine is not deployed in the third host. The method further includes: Receiving, by the routing virtual machine, a third vlan data packet sent by the physical switch, where the third vlan data packet is sent by the virtual switch in the third host to the physical switch, and the third vlan data packet The Ethernet data packet sent by the third VM is encapsulated, the Ethernet data packet is a data packet sent to the second VM, and the third VLAN data packet includes: a fourth vlan corresponding to the third VM a vlan identifier of the port, and address information of the second VM; The routing virtual machine encapsulates the third vlan data packet into a second VXLAN data packet, and sends the second VXLAN data packet to the second host, so that the second host is according to the second VM The address information, and the second VNI, the second VXLAN packet is processed and sent to the second VM, where the second VNI is used to identify a coverage area of a Layer 2 network where the third VM is located. A routing virtual machine, the routing virtual machine is configured to perform communication between a first virtual machine VM and a second VM, the first VM is located at a first host Host, and the second VM is located at a second host, The routing virtual machine is created in the first host, and the routing virtual machine includes: a receiving unit, configured to receive a first virtual local area network vlan data packet sent by the first virtual switch in the first host, where the first vlan data packet is encapsulated by an Ethernet data packet sent by the first VM, The first vlan data packet includes: a vlan identifier of the first vlan port corresponding to the first VM, and address information of the second VM; a packaging unit, configured to encapsulate the first vlan data packet received by the receiving unit into a first virtual extended local area network VXLAN data packet; a sending unit, configured to send, to the second Host, the first VXLAN data packet encapsulated by the encapsulating unit, so that the second Host is based on the address information of the second VM, and the first virtual extended local area network identifier (VNI) Transmitting the first VXLAN data packet to the second VM, where the first VXLAN data packet includes the first VNI, and the first VNI is used to identify a Layer 2 network where the first VM is located. Cover the domain. The routing virtual machine according to claim 6, wherein the second vlan port is created on the first switch, the second vlan port and the first vlan port have the same vlan identifier, and the The second vlan port is connected to the routing virtual machine; The receiving unit is configured to receive a first vlan data packet that is sent by the first virtual switch by using the second vlan port; The encapsulating unit is specifically configured to encapsulate the first vlan data packet into a first VXLAN data packet. The routing virtual machine according to claim 6, wherein a trunk port is created on the first switch, and a third vlan port is created on the routing virtual machine, and the trunk port and the third vlan port are created. Connecting, and the third vlan port has the same vlan identifier as the first vlan port; The receiving unit is configured to receive, by the first virtual switch in the first host, the first vlan data packet sent by the trunk port and the third vlan port corresponding to the vlan identifier; The encapsulating unit is specifically configured to encapsulate the first vlan data packet into a first VXLAN data packet. The routing virtual machine according to any one of claims 6-8, wherein the first host is located in a first private cloud, the second host is located in a second private cloud, and the first private cloud includes a first a layer 2 gateway, the second private cloud includes a second layer 2 gateway; The sending unit is configured to send the first VXLAN data packet to the first Layer 2 gateway, so that the first Layer 2 gateway is configured according to a preset correspondence between the first VNI and the second VNI. Modifying the received first VNI in the first VXLAN data packet to the second VNI, and passing the first VXLAN data packet including the second VNI through the first Layer 2 gateway and the The VXLAN tunnel between the second layer 2 gateways is sent to the second layer 2 gateway, and the second layer 2 gateway receives the received location according to the preset correspondence between the first VNI and the second VNI. The second VNI in the first VXLAN data packet is modified to the first VNI, and the first VXLAN data packet is sent to the second Host according to the first VNI. The routing virtual machine according to any one of claims 6-8, wherein the routing virtual machine is further configured to perform communication between the third VM and the second VM, and the third VM is located in the third The first host and the third host are connected to the same physical switch, and the routing virtual machine is not deployed in the third host; The receiving unit is further configured to receive a third vlan data packet sent by the physical switch, where the third vlan data packet is sent by the virtual switch in the third host to the physical switch, and the third The vlan data packet is encapsulated by an Ethernet data packet sent by the third VM, where the Ethernet data packet is a data packet sent to the second VM, and the third VLAN data packet includes: corresponding to the third VM. a vlan identifier of the fourth vlan port, and address information of the second VM; The encapsulating unit is further configured to encapsulate the third vlan data packet into a second VXLAN data packet; The sending unit is further configured to send the second VXLAN data packet to the second host, so that the second host performs the second according to the address information of the second VM and the second VNI. The VXLAN packet is processed and sent to the second VM, where the second VNI is used to identify the coverage domain of the Layer 2 network where the third VM is located. A routing virtual machine, the routing virtual machine is configured to perform communication between a first virtual machine VM and a second VM, the first VM is located at a first host Host, and the second VM is located at a second host, The routing virtual machine is created in the first host, and the routing virtual machine includes: a transceiver, configured to receive a first virtual local area network vlan data packet sent by the first virtual switch in the first host, where the first vlan data packet is encapsulated by an Ethernet data packet sent by the first VM, The first vlan data packet includes: a vlan identifier of the first vlan port corresponding to the first VM, and address information of the second VM; a processor, configured to encapsulate the first vlan data packet received by the transceiver into a first virtual extended local area network VXLAN data packet; The transceiver is further configured to send, to the second Host, the first VXLAN data packet encapsulated by the processor, so that the second Host is based on address information of the second VM, and the first virtual extension The local area network identifies the VNI, and the first VXLAN data packet is processed and sent to the second VM, where the first VNI is used to identify a coverage area of the layer 2 network where the first VM is located. The routing virtual machine according to claim 11, wherein a second vlan port is created on the first switch, and the second vlan port has the same vlan identifier as the first vlan port, and the The second vlan port is connected to the routing virtual machine; The transceiver is specifically configured to receive a first vlan data packet that is sent by the first virtual switch by using the second vlan port; The processor is specifically configured to encapsulate the first vlan data packet into a first VXLAN data packet. The routing virtual machine according to claim 11, wherein a trunk port is created on the first switch, and a third vlan port is created on the routing virtual machine, and the trunk port and the third vlan port are created. Connecting, and the third vlan port has the same vlan identifier as the first vlan port; The transceiver is configured to receive a first vlan data packet sent by the first virtual switch in the first host by using the trunk port and a third vlan port corresponding to the vlan identifier; The processor is specifically configured to encapsulate the first vlan data packet into a first VXLAN data packet. The routing virtual machine according to any one of claims 11 to 13, wherein the first host is located in a first private cloud, the second host is located in a second private cloud, and the first private cloud includes a first a layer 2 gateway, the second private cloud includes a second layer 2 gateway; The transceiver is specifically configured to send the first VXLAN data packet to the first Layer 2 gateway, so that the first Layer 2 gateway is configured according to a preset correspondence between the first VNI and the second VNI. Modifying the received first VNI in the first VXLAN data packet to the second VNI, and passing the first VXLAN data packet including the second VNI through the first Layer 2 gateway and the The VXLAN tunnel between the second layer 2 gateways is sent to the second layer 2 gateway, and the second layer 2 gateway receives the received location according to the preset correspondence between the first VNI and the second VNI. The second VNI in the first VXLAN data packet is modified to the first VNI, and the first VXLAN data packet is sent to the second Host according to the first VNI. The routing virtual machine according to any one of claims 11 to 13, wherein the routing virtual machine is further configured to perform communication between the third VM and the second VM, and the third VM is located in the third The first host and the third host are connected to the same physical switch, and the routing virtual machine is not deployed in the third host; The transceiver is further configured to receive a third vlan data packet sent by the physical switch, where the third vlan data packet is sent by the virtual switch in the third host to the physical switch, and the third The vlan data packet is encapsulated by an Ethernet data packet sent by the third VM, where the Ethernet data packet is a data packet sent to the second VM, and the third VLAN data packet includes: corresponding to the third VM. a vlan identifier of the fourth vlan port, and address information of the second VM; The processor is further configured to encapsulate the third vlan data packet into a second VXLAN data packet; The transceiver is further configured to send the second VXLAN data packet to the second host, so that the second host, according to the address information of the second VM, and the second VNI, the second The VXLAN packet is processed and sent to the second VM, where the second VNI is used to identify the coverage domain of the Layer 2 network where the third VM is located.

Images