CN114338277A - Method, device, equipment and readable medium for protecting VPN (virtual private network) network node in Anycast scene - Google Patents

Abstract

The present disclosure provides a method, device, device and readable medium for protecting a VPN network node in an Anycast scenario, wherein the method includes: selecting one router among edge routers according to the Anycast address and determining it as a designated representative edge router; determining the other router For the non-designated representative edge router; in response to the routing address sent by the user edge device, trigger the designated representative edge router to assign a VPN identifier; control the designated representative edge router to advertise the VPN route to the non-designated representative edge router through BGP, and the VPN route carries the VPN identifier; Trigger the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the IP route of the customer edge device, and the outgoing information of the local forwarding table corresponds to the IP route of the customer edge device. Through the embodiment of the present disclosure, the P node does not need to maintain or perceive the state table entry, and the forwarding process is simplified.

Description

Protection method, device, device and readable medium for VPN network node in Anycast scenario

technical field

The present disclosure relates to the field of communication technologies, and in particular, to a method, apparatus, device, and readable medium for protecting a VPN network node in an Anycast scenario.

Background technique

At present, the Ti-LFA FRR (Topology-Independent Loop-free Alternate FRR) technology can provide link and node protection for Segment Routing tunnels. When a link or node fails, traffic will quickly switch to the backup path and continue forwarding, thus avoiding the loss of traffic to the greatest extent.

Since the SR TE/SRv6 Policy in the cloud-network integration scenario is the Node Segment (code segment) specified by the node, local protection cannot be performed through Ti-LFA, resulting in the network being in dual PE (Provider Edge, operator edge router) In the node access scenario, the VPN service cannot be protected.

In the related art, the protection scheme for the PE node is to first use the mirrored label to guide it into the corresponding VPN label space, and then look up the table and forward in the corresponding VPN (virtual private network) label space.

However, the PE node needs to maintain the VPN label space, and the upstream P (Provider, operator backbone router) node needs to maintain the state table entry. The whole process of forwarding processing is complicated, which is not conducive to the operation and maintenance management of large-scale networks.

It should be noted that the information disclosed in the above Background section is only for enhancement of understanding of the background of the present disclosure, and therefore may contain information that does not form the prior art that is already known to a person of ordinary skill in the art.

SUMMARY OF THE INVENTION

The purpose of the present disclosure is to provide a protection method, device, device and readable medium for a VPN network node in an Anycast scenario, which are used to at least to a certain extent overcome the complex maintenance status table entries caused by the limitations and defects of the related art. question.

According to a first aspect of the embodiments of the present disclosure, there is provided a method for protecting a VPN network node in an Anycast scenario, including: selecting one router among edge routers according to an Anycast address and determining it as a designated representative edge router; A router is determined as a non-designated representative edge router; in response to the routing address sent by the user edge device, triggering the designated representative edge router to assign a VPN identifier; controlling the designated representative edge router to advertise VPN to the non-designated representative edge router through BGP route, the VPN route carries the VPN identifier; triggers the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the IP route of the user edge device, and the local forwarding The published outbound information corresponds to the IP route of the user edge device.

In an exemplary embodiment of the present disclosure, selecting one of the edge routers according to the Anycast address and determining it as the designated representative edge router includes: determining a target operator edge router deployed with the same VPN and the same Anycast address; taking the VPN as the granularity Or elect an alternative designated representative edge router in the target operator edge router with routing equipment as the granularity, construct Anycast_DR_Route on the alternative designated representative edge router, and determine the keywords in the Anycast_DR_Route; according to the The keyword sorts Anycast_DR_Route; according to the sorting result, it is determined that one of the alternative designated representative edge routers is the designated representative edge router.

In an exemplary embodiment of the present disclosure, an alternative designated representative edge router is elected in the target operator edge router with VPN as granularity or routing device as granularity, and the alternative designated representative edge router Constructing Anycast_DR_Route on the above, and determining the keywords in the Anycast_DR_Route include: electing one of the operator edge routers as an alternative designated representative edge router with VPN as the granularity, and then electing as the alternative designated representative edge router Build the first Anycast_DR_Route on the operator edge router, and use the route identifier and the anycast address as the keywords of the first Anycast_DR_Route; or elect one of the operator edge routers as the standby A designated representative edge router is selected, a second Anycast_DR_Route is constructed on the operator's edge router elected as the alternative designated representative edge router, and the anycast address is used as a key of the second Anycast_DR_Route.

In an exemplary embodiment of the present disclosure, if the designated representative edge router is an ASBR device, the BGP carries attribute information of the Anycast_DR_Route, and the attribute information includes IPv6 specific extension group and type information.

In an exemplary embodiment of the present disclosure, the method further includes: the non-designated representative edge router receives the VPN route, and determines the next-hop routing device carrying the attribute information by the non-designated representative edge router. The priority is lower than the priority of the next-hop routing device that does not carry the attribute information.

In an exemplary embodiment of the present disclosure, the Anycast_DR_Route includes a route identifier, an address length, an anycast address, and a local virtual tunnel port address.

In an exemplary embodiment of the present disclosure, the encapsulation format of the VPN route is one of VPNv4, VPNv6, and EVPNRT5.

According to a second aspect of the embodiments of the present disclosure, there is provided a protection device for a VPN network node in an Anycast scenario, including: a determination module configured to select one router in the edge routers according to the Anycast address and determine it as a designated representative edge router; the determining The module is also configured to determine another router in the edge router as a non-designated representative edge router; the triggering module is configured to trigger the designated representative edge router to allocate a VPN identifier in response to the routing address sent by the user edge device; control A module configured to control the designated representative edge router to advertise a VPN route to the non-designated representative edge router through BGP, and the VPN route carries the VPN identifier; the triggering module is also configured to trigger the non-designated representative edge router The edge router generates a local forwarding table according to the routing address received by the designated representative edge router and the IP route of the user edge device, and the outgoing information of the local forwarding table corresponds to the IP route of the user edge device.

According to a third aspect of the present disclosure, there is provided an electronic device comprising: a memory; and a processor coupled to the memory, the processor configured to execute any one of the above based on instructions stored in the memory method described in item.

According to a fourth aspect of the present disclosure, there is provided a computer-readable storage medium on which a program is stored, and when the program is executed by a processor, implements the method for protecting a VPN network node in an Anycast scenario as described in any one of the above.

In this embodiment of the present disclosure, by selecting one of the edge routers according to the Anycast address and determining it as a designated representative edge router, and determining the other router as a non-designated representative edge router, the designated representative edge router is triggered to assign a VPN identifier, and the non-designated representative edge router is triggered to be assigned a VPN identifier, and the non-designated representative edge router is triggered through BGP. The designated representative edge router advertises VPN routes. The non-designated representative edge router generates a local forwarding table based on the routing address received by the designated representative edge router and the IP route of the customer edge device. The outgoing information in the local forwarding table corresponds to the customer edge device IP route and the VPN route. There is no need to generate FRR (Fast Reroute, fast rerouting) entries, and no need to deploy end-to-end BFD (Bidirectional Forwarding Detection, a network protocol for detecting faults between two forwarding points) detection, VPN routing when PE nodes fail No handover is required. As long as the SRv6 route of the public network Ti-LFA is quickly switched or converged, the traffic can be diverted to the backup PE node and forwarded to the CE (customer edge equipment) device normally, which simplifies the forwarding process.

Further, the embodiments of the present disclosure can also be applied to an ASBR (Autonomous System BorderRouter, autonomous system border router) device protection scenario, which has strong applicability.

It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure.

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description serve to explain the principles of the disclosure. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and for those of ordinary skill in the art, other drawings can also be obtained from these drawings without creative effort.

1 shows a flowchart of a method for protecting a VPN network node in an Anycast scenario in an exemplary embodiment of the present disclosure;

2 shows a flowchart of a method for protecting a VPN network node in an Anycast scenario in another exemplary embodiment of the present disclosure;

3 shows a flowchart of a method for protecting a VPN network node in an Anycast scenario in another exemplary embodiment of the present disclosure;

4 shows a flowchart of a method for protecting a VPN network node in an Anycast scenario in another exemplary embodiment of the present disclosure;

FIG. 5 shows a schematic diagram of the architecture of the protection scheme of the VPN network node in the Anycast scenario in an exemplary embodiment of the present disclosure;

FIG. 6 shows a schematic diagram of the architecture of the protection scheme of the VPN network node in the Anycast scenario in another exemplary embodiment of the present disclosure;

FIG. 7 shows a schematic diagram of the architecture of the protection scheme of the VPN network node in the Anycast scenario in another exemplary embodiment of the present disclosure;

FIG. 8 shows a schematic diagram of the architecture of the protection scheme of the VPN network node in the Anycast scenario in another exemplary embodiment of the present disclosure;

9 shows a block diagram of a protection device for a VPN network node in an Anycast scenario in an exemplary embodiment of the present disclosure;

FIG. 10 shows a block diagram of an electronic device in an exemplary embodiment of the present disclosure.

Detailed ways

Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments, however, can be embodied in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided in order to give a thorough understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be employed. In other instances, well-known solutions have not been shown or described in detail to avoid obscuring aspects of the present disclosure.

In addition, the drawings are merely schematic illustrations of the present disclosure, and the same reference numerals in the drawings denote the same or similar parts, and thus their repeated descriptions will be omitted. Some of the block diagrams shown in the figures are functional entities that do not necessarily necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, or in one or a hardware module or integrated circuit, or in different networks and/or processor devices and/or microcontroller devices.

The technical solutions of the present disclosure involve the following important concepts.

(1) SRV6: Through SR (Segment Routing, segment routing) technology, the first node in the network plans and establishes an end-to-end connection path. The intermediate nodes only need to forward and do not need to maintain the connection state. SRV6 combines IPv6 (sixth generation) Internet) technology and SR technology, it is no longer necessary to use an independent signaling protocol to distribute labels for each node in the network. At the same time, SRv6 only needs to be extended on the basis of the original IPv6, and the IPv6 tunnel can be used to forward data without the need for Additional use of MPLS (Multi-Protocol Label Switching, Multi-Protocol Label Switching) tunnel for data forwarding.

(2) In the VPN concept, the routers in the entire network are divided into three categories: customer edge routers (CE), carrier edge routers (PE) and carrier backbone routers (P); among them, PE acts as an IP VPN access router .

(2.1), PE (Provider Edge): the edge device of Provide, the edge router of the service provider's backbone network, which is equivalent to the label edge router (LER). The PE router connects the CE router and the P router and is the most important network node. The user's traffic flows into the user network through the PE router, or flows to the MPLS backbone network through the PE router.

(2.2), CE (Customer Edge): customer edge equipment, the customer end router connected to the service provider. CE routers provide service access for users by connecting to one or more PE routers. A CE router is usually an IP router that establishes an adjacency relationship with the connected PE router.

(3) EVPN: Ethernet VPN, which was originally defined by RFC7432. The RFC is spelled BGP MPLS-BasedEthernet VPN. EVPN is also used to transmit IP routing information, as the control layer of overlay networks such as VXLAN, and used as data center interconnection control layer, etc.

(4) BGP: Border Gateway Protocol, which is used to exchange routing information between different autonomous systems (AS). When two ASs need to exchange routing information, each AS must designate a node running BGP to exchange routing information with other ASs on behalf of the AS. BGP uses TCP (Transmission Control Protocol) as the transport layer protocol.

(5) RD: route distinguisher, 64 bits, used to distinguish IPv4 prefixes that use the same address space, and the IPv4 address with RD added is called a VPN-IPv4 address (ie, a VPNv4 address). After the PE receives the IPv4 route from the CE, it converts it into a globally unique VPN-IPv4 route and advertises it on the public network.

(6) RT: Route Target, used to distinguish VPN customers (clients), is an extended attribute of BGP community (groups), configured in VRF, and transmitted together with the VPNv4 prefix, a route can be attached with multiple RT value.

As shown in Figure 5, the protection architecture of the VPN network node in the Anycast scenario includes: two user edge devices are respectively recorded as the first user edge device CE1 and the second user edge device CE2; four operator edge routers are respectively recorded as the first user edge device CE1 and the second user edge device CE2. The carrier edge router PE1, the second carrier edge router PE2, the third carrier edge router PE3 and the fourth carrier edge router PE4; the two backbone carrier backbone routers are respectively recorded as the first carrier backbone router P1 and the second carrier backbone router P1. Carrier backbone router P2.

In an exemplary embodiment of the present disclosure, Anycast1 interaction is implemented between the first carrier edge router PE1 and the second carrier edge router PE2.

In an exemplary embodiment of the present disclosure, Anycast3 interaction is implemented between the third carrier edge router PE3 and the fourth carrier edge router PE4.

In an exemplary embodiment of the present disclosure, Anycast2 interaction is implemented between the backbone router P1 of the first operator and the backbone router P2 of the second operator.

In the embodiment shown in FIG. 5 , the PE node needs to maintain multiple VPN label spaces, and the upstream P node needs to maintain state table entries. The whole process of forwarding processing is complicated, which is not conducive to large network operation and maintenance management.

Exemplary embodiments of the present disclosure will be described in detail below with reference to FIGS. 1 to 10 .

FIG. 1 is a flowchart of a method for protecting a VPN network node in an Anycast scenario in an exemplary embodiment of the present disclosure.

Referring to FIG. 1, the protection method of the VPN network node in the Anycast scenario may include:

In step S102, one router in the edge routers is selected according to the Anycast address and determined as the designated representative edge router.

Step S104, determining another router in the edge routers as a non-designated representative edge router.

Step S106, in response to the routing address sent by the user edge device, trigger the designated representative edge router to assign a VPN identifier.

Step S108, controlling the designated representative edge router to advertise a VPN route to the non-designated representative edge router through BGP, where the VPN route carries the VPN identifier.

Step S110, triggering the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the IP route of the user edge device, and the outgoing information of the local forwarding table corresponds to the user edge. Device IP routing.

In this embodiment of the present disclosure, by selecting one of the edge routers according to the Anycast address and determining it as a designated representative edge router, and determining the other router as a non-designated representative edge router, the designated representative edge router is triggered to assign a VPN identifier, and the non-designated representative edge router is triggered to be assigned a VPN identifier, and the non-designated representative edge router is triggered through BGP. The designated representative edge router advertises VPN routes. The non-designated representative edge router generates a local forwarding table based on the routing address received by the designated representative edge router and the IP route of the customer edge device. The outgoing information in the local forwarding table corresponds to the customer edge device IP route and the VPN route. There is no need to generate FRR (Fast Reroute, fast rerouting) entries, and no need to deploy end-to-end BFD (Bidirectional Forwarding Detection, a network protocol for detecting faults between two forwarding points) detection, VPN routing when PE nodes fail No handover is required. As long as the SRv6 route of the public network Ti-LFA is quickly switched or converged, the traffic can be diverted to the backup PE node and forwarded to the CE (customer edge equipment) device normally, which simplifies the forwarding process.

Below, each step of the protection method of the VPN network node in the Anycast scenario will be described in detail with reference to FIG. 2 to FIG. 4 .

In an exemplary embodiment of the present disclosure, as shown in FIG. 2 , selecting one of the edge routers according to the Anycast address and determining it as the designated representative edge router includes:

Step S202: Determine the target operator edge routers deployed with the same VPN and the same Anycast address.

Step S204, electing an alternative designated representative edge router in the target operator edge router with the VPN as the granularity or the routing device as the granularity, constructing Anycast_DR_Route on the alternative designated representative edge router, and determining in the Anycast_DR_Route keyword.

Step S206: Sort Anycast_DR_Route according to the keywords.

Step S208, according to the result of the sorting, determine that one of the alternative designated representative edge routers is the designated representative edge router.

In an exemplary embodiment of the present disclosure, Anycast_DR_Route includes contents as shown in Table 1 below:

Table 1 Anycast_DR_Route

In an exemplary embodiment of the present disclosure, a DR device is elected from a group of devices deployed with the same VPN and Anycast address, and Anycast_DR_Route is constructed on the PE device, where "RD" fills in the RD1 of the VPN, and "Anycast IPv6Address" is The public network Anycast IPv6 address configured on the device, "Originating Router's IP Address" is the address that can uniquely identify the PE device, which can be the router-ID of the device, and carries the RT attribute of the VPN.

In an exemplary embodiment of the present disclosure, as shown in FIG. 3 , an alternative designated representative edge router is elected in the target operator edge router with VPN as granularity or routing device as granularity. The alternative designation represents the construction of Anycast_DR_Route on the edge router, and determines that the keywords in the Anycast_DR_Route include:

Step S302, electing one of the operator edge routers as an alternative designated representative edge router with VPN as the granularity, and constructing a first Anycast_DR_Route on the operator edge router elected as the alternative designated representative edge router, and The route identifier and the anycast address are used as the keywords of the first Anycast_DR_Route.

Step S304, or elect one of the operator edge routers as the alternative designated representative edge router with the routing device as the granularity, and construct the first edge router on the operator edge router elected as the alternative designated representative edge router. Second Anycast_DR_Route, and use the anycast address as the key of the second Anycast_DR_Route.

In an exemplary embodiment of the present disclosure, on the basis of the architecture shown in FIG. 5 , as shown in FIG. 6 , the device for electing a DR includes the following implementations:

(1) A DR device 602 is elected between PE3 and PE4. The DR device 602 is responsible for automatically assigning VPN SIDs, and the non-DR devices 604 use VPN SIDs (Security Identifiers) as mirror devices, which are referred to as VPN identifiers for short.

(2) The DR device 602PE4 advertises the L3VPN route through BGP after receiving the CE-side route IP1 (only the optimal routing path is delivered), and the L3VPN route can be encapsulated in one of VPNv4, VPNv6, and EVPN RT5, and carries the automatic distribution VPN. SID.

(3) The non-DR device 604 PE3 does not need to advertise the route IP1 on the CE side after receiving the route IP1, and generates a local forwarding table according to the route IP1 received by the PE4 and the IP1 route on the CE side. The VPN SID of IP1 on PE3 is the same as the VPNSID of the IP1 route advertised by PE4, for example, "Anycast Locator3", but the outgoing information (outbound interface, next hop, etc.) of the forwarding table uses the information of the IP1 route on the CE side.

As shown in Figure 7, the loopback1 address of PE3 is 11::1::1, the Anycast IP is 10::1:1, and the VPN1 is RD1/RT1. The loopback1 address of PE4 is 11::2::2, the Anycast IP is 10::1:1, and the VPN1 is RD1/RT1.

In an exemplary embodiment of the present disclosure, if the designated representative edge router is an ASBR device, the BGP carries attribute information of the Anycast_DR_Route, and the attribute information includes IPv6 specific extension group and type information.

In an exemplary embodiment of the present disclosure, the Anycast VPN protection mechanism is applied to the ASBR device, and the DR role can be elected based on the device, that is, the RD field of the Anycast_DR_Route route does not need to be filled.

In an exemplary embodiment of the present disclosure, as shown in FIG. 4 , the protection method for a VPN network node in the Anycast scenario further includes:

Step S402, the non-designated representative edge router receives the VPN route, and determines that the non-designated representative edge router carries the attribute information The priority of the next-hop routing device that does not carry the attribute information is lower than the priority of the next-hop routing device that does not carry the attribute information. The priority of the next-hop routing device.

In an exemplary embodiment of the present disclosure, as shown in FIG. 8 , after the non-DR device 804 receives the VPN route of the DR device 802, the priority of the next hop carrying the Anycast_DR attribute is lower than that of the next hop without this attribute , so as to ensure that the route advertised from the PE takes precedence instead of the DR device 02, that is, the ASBR2 (autonomous system border router) device is also generated on the ASBR1 (autonomous system border router) with "Locator2: Fun1" as the VPN SID. Forward the entry.

In an exemplary embodiment of the present disclosure, the Anycast_DR_Route includes a route identifier, an address length, an anycast address, and a local virtual tunnel port address.

In an exemplary embodiment of the present disclosure, the encapsulation format of the VPN route is one of VPNv4, VPNv6, and EVPNRT5.

In an exemplary embodiment of the present disclosure, BGP VPNv4, VPNv6, and EVPN RT5 routes determine whether to automatically assign a local VPN SID according to the DR role of the device, and only the DR device automatically assigns the VPN SID and advertises routes to BGP neighbors. The advertisement carries the newly delivered Anycast_DR_Route attribute, and the Anycast_DR_Route attribute is the BGPIPv6-Address-Specific Extended Community (specific extended group) attribute.

In an exemplary embodiment of the present disclosure, the Anycast_DR_Route attribute is defined as shown in Table 2 below:

Table 2

Type=0x0012 (new type) IPv6 address (fill in the IPV6 Anycast address)

Corresponding to the above method embodiments, the present disclosure further provides a protection device for VPN network nodes in an Anycast scenario, which can be used to execute the above method embodiments.

FIG. 9 is a block diagram of an apparatus for protecting a VPN network node in an Anycast scenario in an exemplary embodiment of the present disclosure.

Referring to FIG. 9 , the protection device 900 of the VPN network node in the Anycast scenario may include:

The determining module 902 is configured to select one router in the edge routers according to the Anycast address and determine it as the designated representative edge router.

The determining module 902 is configured to determine another router in the edge routers as a non-designated representative edge router.

The triggering module 904 is configured to trigger the designated representative edge router to assign the VPN identifier in response to the routing address sent by the user edge device.

The control module 906 is configured to control the designated representative edge router to advertise a VPN route to the non-designated representative edge router through BGP, where the VPN route carries the VPN identifier.

The triggering module 904 is configured to trigger the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the IP route of the user edge device, and the outgoing information of the local forwarding table corresponds to routed to the user edge device IP.

In an exemplary embodiment of the present disclosure, the determining module 902 is further configured to: determine the target operator edge router deployed with the same VPN and the same Anycast address; Selecting an alternative designated representative edge router from the target operator's edge router, constructing Anycast_DR_Route on the alternative designated representative edge router, and determining the keywords in the Anycast_DR_Route; sorting the Anycast_DR_Route according to the keywords; The result of the sorting determines that one of the alternative designated representative edge routers is the designated representative edge router.

In an exemplary embodiment of the present disclosure, the determining module 902 is further configured to: elect one of the operator edge routers as an alternative designated representative edge router with VPN as the granularity, The alternative designation is to construct the first Anycast_DR_Route on the operator edge router representing the edge router, and use the route identifier and the anycast address as the keywords of the first Anycast_DR_Route; or elect the operator edge router with the routing device as granularity as the alternative designated representative edge router, construct a second Anycast_DR_Route on the operator edge router elected as the alternative designated representative edge router, and use the anycast address as the key of the second Anycast_DR_Route Character.

In an exemplary embodiment of the present disclosure, if the designated representative edge router is an ASBR device, the BGP carries attribute information of the Anycast_DR_Route, and the attribute information includes IPv6 specific extension group and type information.

In an exemplary embodiment of the present disclosure, the determining module 902 is further configured to: the non-designated representative edge router receives the VPN route, and determines that the non-designated representative edge router carries the attribute information. The priority of the next-hop routing device is lower than the priority of the next-hop routing device that does not carry the attribute information.

In an exemplary embodiment of the present disclosure, the Anycast_DR_Route includes a route identifier, an address length, an anycast address, and a local virtual tunnel port address.

In an exemplary embodiment of the present disclosure, the encapsulation format of the VPN route is one of VPNv4, VPNv6, and EVPNRT5.

Since the functions of the protection device 900 for the VPN network node in the Anycast scenario have been described in detail in the corresponding method embodiments, the present disclosure will not repeat them here.

To sum up, the protection solutions for VPN network nodes in the Anycast scenario disclosed by the embodiments of the present disclosure have at least the following advantages:

(1) Define the negotiation mechanism: For L3VPN services or L3EVPN services, PE3 and PE4 advertise routes carrying the same SRV6 VPN SID, and VPN routes forward VPN traffic to any outgoing PE device through the iterative public network anycast address. handle it correctly.

(2) The VPN route of the corresponding device does not need to generate and maintain FRR entries, nor does it need to deploy end-to-end BFD detection.

(3) The VPN route does not need to be switched when the PE node fails. As long as the SRV6 route Ti-LFA of the public network is quickly switched or converged, the traffic can be diverted to the backup PE node and forwarded to the CE device normally.

It should be noted that although several modules or units of the apparatus for action performance are mentioned in the above detailed description, this division is not mandatory. Indeed, according to embodiments of the present disclosure, the features and functions of two or more modules or units described above may be embodied in one module or unit. Conversely, the features and functions of a module or unit described above may be further divided into modules or units to be embodied.

In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

As will be appreciated by one skilled in the art, various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention can be embodied in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, which may be collectively referred to herein as implementations "circuit", "module" or "system".

The electronic device 1000 according to this embodiment of the present invention is described below with reference to FIG. 10 . The electronic device 1000 shown in FIG. 10 is only an example, and should not impose any limitations on the function and scope of use of the embodiments of the present invention.

As shown in FIG. 10, electronic device 1000 takes the form of a general-purpose computing device. Components of the electronic device 1000 may include, but are not limited to, the above-mentioned at least one processing unit 1010 , the above-mentioned at least one storage unit 1020 , and a bus 1030 connecting different system components (including the storage unit 1020 and the processing unit 1010 ).

Wherein, the storage unit stores program codes, and the program codes can be executed by the processing unit 1010, so that the processing unit 1010 executes various exemplary methods according to the present invention described in the above-mentioned “Exemplary Methods” section of this specification Implementation steps. For example, the processing unit 1010 may execute the methods shown in the embodiments of the present disclosure.

The storage unit 1020 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 10201 and/or a cache storage unit 10202 , and may further include a read only storage unit (ROM) 10203 .

The storage unit 1020 may also include a program/utility 10204 having a set (at least one) of program modules 10205, such program modules 10205 including, but not limited to: an operating system, an or application program, other program modules, and program data, examples of which are Each or some combination of these may include an implementation of a network environment.

The bus 1030 may be representative of one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any of a variety of bus structures bus.

The electronic device 1000 may also communicate with one or an external device 1040 (eg, a keyboard, pointing device, Bluetooth device, etc.), a device or a device that enables a user to interact with the electronic device 1000, and/or a device that enables the electronic device 1000 1000 can communicate with any device (eg, router, modem, etc.) that communicates with one or other computing devices. Such communication may occur through input/output (I/O) interface 1050 . Also, the electronic device 1000 may communicate with one or a network (eg, a local area network (LAN), a wide area network (WAN), and/or a public network such as the Internet) through a network adapter 1060 . As shown, network adapter 1060 communicates with other modules of electronic device 1000 via bus 1030 . It should be appreciated that, although not shown, other hardware and/or software modules may be used in conjunction with electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives and data backup storage systems.

From the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein may be implemented by software, or may be implemented by software combined with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure may be embodied in the form of software products, and the software products may be stored in a non-volatile storage medium (which may be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to cause a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to an embodiment of the present disclosure.

In an exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium on which a program product capable of implementing the above-described method of the present specification is stored. In some possible implementations, aspects of the present invention can also be implemented in the form of a program product comprising program code for enabling the program product to run on a terminal device The terminal device performs the steps according to various exemplary embodiments of the present invention described in the "Example Method" section above in this specification.

A program product for implementing the above method according to an embodiment of the present invention may employ a portable compact disc read only memory (CD-ROM) and include program codes, and may run on a terminal device such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

The program product may employ one or any combination of readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections with one or wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

A computer readable signal medium may include a propagated data signal in baseband or as part of a carrier wave with readable program code embodied thereon. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium can also be any readable medium, other than a readable storage medium, that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

Program code embodied on a readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural Programming Language - such as the "C" language or similar programming language. The program code may execute entirely on the user computing device, partly on the user device, as a stand-alone software package, partly on the user computing device and partly on a remote computing device, or entirely on the remote computing device or server execute on. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (eg, using an Internet service provider business via an Internet connection).

Furthermore, the above-mentioned figures are merely schematic illustrations of the processes included in the methods according to the exemplary embodiments of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the chronological order of these processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, for example, in modules.

Other embodiments of the present disclosure will readily suggest themselves to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or techniques in the technical field not disclosed by the present disclosure . The specification and examples are to be regarded as exemplary only, with the true scope and spirit of the disclosure being indicated by the claims.

Claims (10)

1. the protection method of VPN network node under a kind of Anycast scene, is characterized in that, comprises: Select one of the edge routers according to the Anycast address and determine it as the designated representative edge router; determining another router in the edge routers as a non-designated representative edge router; In response to the routing address sent by the user edge device, triggering the designation on behalf of the edge router to assign the VPN identifier; Controlling the designated representative edge router to advertise a VPN route to the non-designated representative edge router through BGP, and the VPN route carries the VPN identifier; Trigger the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the IP route of the customer edge device, and the outgoing information of the local forwarding table corresponds to the IP route of the customer edge device . 2. the protection method of VPN network node under the Anycast scenario as claimed in claim 1, it is characterized in that, according to Anycast address, choose a router in edge router and be determined to be designated to represent edge router and comprise: Identify the target carrier edge routers deployed with the same VPN and the same Anycast address; Selecting an alternative designated representative edge router in the target operator edge router with VPN as granularity or routing device as granularity, constructing Anycast_DR_Route on the alternative designated representative edge router, and determining the keywords in the Anycast_DR_Route ; Sort Anycast_DR_Route according to the keyword; According to the result of the sorting, one of the alternative designated representative edge routers is determined as the designated representative edge router. 3. the protection method of VPN network node under the Anycast scenario as claimed in claim 2, it is characterized in that, with VPN as granularity or with routing equipment as granularity in described target operator edge router electing alternative designated representative edge The router constructs Anycast_DR_Route on the alternative designated representative edge router, and determines that the keywords in the Anycast_DR_Route include: With VPN as the granularity, one of the operator edge routers is elected as an alternative designated representative edge router, and the first Anycast_DR_Route is constructed on the operator edge router elected as the alternative designated representative edge router, and the route identifier is used. and anycast address as the keyword of the first Anycast_DR_Route; Or elect one of the operator edge routers as the alternative designated representative edge router with the routing device as the granularity, and construct a second Anycast_DR_Route on the operator edge router elected as the alternative designated representative edge router, and use the anycast address as the key of the second Anycast_DR_Route. 4. the protection method of VPN network node under the Anycast scenario as claimed in claim 2 or 3, is characterized in that, If the designated representative edge router is an ASBR device, the BGP carries attribute information of the Anycast_DR_Route, and the attribute information includes IPv6 specific extension group and type information. 5. the protection method of VPN network node under the Anycast scenario as claimed in claim 4, is characterized in that, also comprises: The non-designated representative edge router receives the VPN route, and determines that the priority of the next-hop routing device that carries the attribute information on the non-designated representative edge router is lower than the next hop that does not carry the attribute information. The priority of the routing device. 6. the protection method of VPN network node under the Anycast scenario as claimed in claim 2 or 3, is characterized in that, The Anycast_DR_Route includes a route identifier, an address length, an anycast address and an address of a local virtual tunnel port. 7. the protection method of VPN network node under the Anycast scenario as described in any one of claim 1-3, is characterized in that, The encapsulation format of the VPN route is one of VPNv4, VPNv6 and EVPN RT5. 8. a protection device for a VPN network node under an Anycast scenario, characterized in that it comprises: The determining module is set to select a router in the edge routers according to the Anycast address and determine it as the designated representative edge router; The determining module is further configured to determine another router in the edge routers as a non-designated representative edge router; a triggering module, configured to trigger the designated representative edge router to allocate a VPN identifier in response to the routing address sent by the user edge device; A control module, configured to control the designated representative edge router to advertise a VPN route to the non-designated representative edge router through BGP, and the VPN route carries the VPN identifier; The triggering module is further configured to trigger the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the IP route of the user edge device, and the outgoing information of the local forwarding table corresponds to routed to the user edge device IP. 9. An electronic device, characterized in that, comprising: memory; and A processor coupled to the memory, the processor configured to perform the method of protecting a VPN network node in an Anycast scenario according to any one of claims 1-7 based on instructions stored in the memory. 10. A computer-readable storage medium having a program stored thereon, and when the program is executed by a processor, implements the protection method for a VPN network node in an Anycast scenario according to any one of claims 1-7.

Images