WO2017032300A1 - 一种数据传输方法、虚拟网络管理装置及数据传输*** - Google Patents

一种数据传输方法、虚拟网络管理装置及数据传输*** Download PDF

Info

Publication number
WO2017032300A1
WO2017032300A1 PCT/CN2016/096372 CN2016096372W WO2017032300A1 WO 2017032300 A1 WO2017032300 A1 WO 2017032300A1 CN 2016096372 W CN2016096372 W CN 2016096372W WO 2017032300 A1 WO2017032300 A1 WO 2017032300A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
gateway
address
subnet
router
Prior art date
Application number
PCT/CN2016/096372
Other languages
English (en)
French (fr)
Inventor
段可博
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201610698151.8A external-priority patent/CN106487695B/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2017032300A1 publication Critical patent/WO2017032300A1/zh

Links

Images

Definitions

  • the present invention relates to the field of communications, and in particular, to a data transmission method, a virtual network management device, and a data transmission system.
  • Data center communications include east-west communications and north-south communications.
  • the east-west communication refers to the internal communication of the data center
  • the north-south communication refers to the communication between the data center and the external network.
  • FIG. 1 is a schematic diagram of communication between virtual networks in a data center in the prior art, wherein the data center includes a computing node and a network node, and the computing node 1 includes a virtual machine (English name: Virtual Machine, English abbreviation: VM) 1 and The virtual machine 2, the computing node 2 includes a virtual machine 3, wherein the virtual machine 1 and the virtual machine 3 belong to the virtual network 1, and the virtual machine 2 belongs to the virtual network 2.
  • the virtual machine exchanges data through the virtual machine switch (English full name: Virtual Switch, English abbreviation: VS) in the compute node.
  • the virtual machine switch English full name: Virtual Switch, English abbreviation: VS
  • communication data is centrally forwarded through a router, that is, east-west communication traffic between the virtual network 1 and the virtual network 2 needs to be forwarded through a router on the network node 1, the virtual network 1 and
  • the communication traffic of the external users of the data center also needs to be forwarded between the routers on the network node 1 and the routers at the user edge (English name: Customer Edge: CE).
  • Floating network interconnection protocol English full name: Internet Protocol, English abbreviation: IP
  • Address mode North-South communication The virtual machine of the data center is used as the server side of the client-server communication mode, and the public network address (floating IP) is configured. External users access VMs in the data center through public network addresses.
  • Direct-connected network mode North-South communication The VM in the data center acts as a client or server, and configures a private network address. It communicates with external branches or remote users through a virtual private network (English name: Virtual Private Network, English abbreviation: VPN). .
  • VPN Virtual Private Network
  • Source address translation (English name: Source Network Address Translation, English abbreviation: SNAT) mode North-South communication: multiple VMs in the data center share a public IP address through SNAT, as a client to access the server on the external network.
  • SNAT Source Network Address Translation
  • the cloud computing platform in the prior art provides a distributed solution to the first north-south communication method described above, but the other two methods of north-south communication data are completely dependent on the existing centralized processing scheme for forwarding. Due to the processing capability of the router on the network node, when the direct-connected network mode has a large north-south communication traffic, or the SNAT mode has a large north-south communication traffic, the data forwarding efficiency is low and the communication delay is large.
  • Embodiments of the present invention provide a data transmission method, a virtual network management apparatus, and a data transmission system, which can provide a distributed solution for direct-to-network mode north-south communication, improve data forwarding efficiency, and reduce communication delay.
  • a data transmission method includes:
  • the network identification information includes subnet information of the virtual network
  • the subnet information is used to identify a subnet of the virtual network
  • the subnet of the virtual network includes a first sub network
  • router information where the router information is used to indicate a connection status between the router and a subnet of the virtual network, and a connection status between the router and the external network;
  • the network identification information is , Sending the router information and the virtual machine information to the computing node where the virtual machine is located, instructing the computing node to create a gateway, and configuring the gateway, where the gateway is used to send a VPN packet to the virtual private network. Forward.
  • the configuring the gateway includes:
  • the gateway Adding an uplink interface to the gateway, where the uplink interface is an interface of the external network, and is used for performing VPN packet forwarding with a user edge CE router;
  • the forwarding policy includes: a VPN packet received from the virtual machine, where a next hop address is an address of a downlink interface of the CE router; The VPN packet received by the downlink interface of the CE router. The destination address is the address of the virtual machine.
  • the method further includes:
  • routing information issuing module is configured to advertise the routing information of the virtual machine to the CE router by using the routing information issuing module, so that the CE router maintains an updated CE routing table, where the content recorded in the CE routing table includes The VPN packet received by the external network, and the next hop address is the address of the uplink interface of the gateway.
  • the creating a routing information publishing module includes:
  • routing information publisher instance creating a routing information publisher instance, configuring a separate address space for the routing information publisher instance, and connecting the routing information publisher instance to a routing agent, where the routing information publisher instance is used to dynamically
  • the corresponding router instance on the CE router sends routing information of the virtual machine.
  • the routing information that is sent by the routing information issuing module to the CE router to dynamically advertise the routing information of the virtual machine includes:
  • the routing information issuing module issues the updated routing information of the virtual machine to the CE router.
  • the method further includes:
  • the gateway is revoked.
  • a virtual network management apparatus includes:
  • a virtual network management module configured to acquire network identifier information of the virtual network, where the network identifier information includes subnet information of the virtual network, where the subnet information is used to identify a subnet of the virtual network, and the virtual network
  • the subnet includes the first subnet
  • a network node management module configured to acquire router information, where the router information is used to indicate a connection status between the router and a subnet of the virtual network, and a connection status between the router and the external network;
  • a computing node management module configured to acquire virtual machine information, where the virtual machine information is used to indicate a subnet to which the virtual machine is connected;
  • the computing node management module determines that the subnet to which the virtual machine is connected is the first subnet, and the first subnet is connected to the router, and the router is connected to the external network, Sending the network identification information, the router information, and the virtual machine information to a computing node where the virtual machine is located, to instruct the computing node to create a gateway, and configuring the gateway, where the gateway is used to Forward the virtual private network VPN packets.
  • the computing node management module is specifically configured to:
  • the gateway Adding an uplink interface to the gateway, where the uplink interface is an interface of the external network, and is used for performing VPN packet forwarding with a user edge CE router;
  • the forwarding policy includes: a VPN packet received from the virtual machine, where a next hop address is an address of a downlink interface of the CE router; The VPN packet received by the downlink interface of the CE router.
  • the destination address is the virtual address. The address of the machine.
  • the network node management module is further configured to create a routing information publishing module, and send the module to the CE by using the routing information
  • the router advertises the routing information of the virtual machine, so that the CE router maintains the updated CE routing table, and the content recorded in the CE routing table includes the VPN packet received from the external network, and the next hop address is the The address of the gateway upstream interface.
  • the network node management module is specifically configured to create a routing information publisher instance, and configure the routing information publisher instance independently.
  • An address space is provided, and the routing information publisher instance is connected to the routing agent, and the routing information publisher instance is configured to send routing information of the virtual machine to a corresponding router instance on the CE router by using a dynamic routing protocol.
  • the network node management module is specifically configured to: after the virtual machine is created, migrated, or revoked, pass the routing information.
  • the publishing module issues updated routing information of the virtual machine to the CE router.
  • the network node management module is further configured to obtain updated router information
  • the computing node management module is further configured to: when the connection between the first subnet and the router is disconnected, or the connection between the router and the external network, according to the updated router information When disconnected, the gateway is revoked;
  • the computing node management module is further configured to obtain updated virtual machine information from the computing node;
  • the computing node management module is further configured to: when the connection between the virtual machine and the first subnet is disconnected, cancel the gateway according to the updated virtual machine information.
  • a third aspect is a data transmission system, comprising: a cloud resource manager, a virtual network management device, a network node, and a computing node;
  • the cloud resource manager is configured to create a virtual network, and send network identification information of the virtual network to the virtual network management device, where the network identification information includes subnet information of the virtual network, the sub The network information is used to identify a subnet of the virtual network, and the subnet of the virtual network includes a first subnet;
  • the cloud resource manager is further configured to instruct the network node to create a router, and configure a connection state between the router and a subnet of the virtual network, and a connection state between the router and an external network;
  • the network node is configured to send router information to the virtual network management device, where the router information is used to indicate a connection state between a router and a subnet of the virtual network, and between the router and an external network. Connection status
  • the cloud resource manager is further configured to instruct the computing node to create a virtual machine, and connect the virtual machine to a subnet of the virtual network;
  • the computing node is further configured to send virtual machine information to the virtual network management device, where the virtual machine information is used to indicate a subnet to which the virtual machine is connected;
  • the virtual network management device determines that the subnet to which the virtual machine is connected is the first subnet, and the first subnet is connected to the router, and the router is connected to the external network, Sending the network identification information, the router information, and the virtual machine information to a computing node where the virtual machine is located, to instruct the computing node to create a gateway, and configuring the gateway, where the gateway is used to Forward the virtual private network VPN packets.
  • the virtual network management device is specifically configured to:
  • the gateway Adding an uplink interface to the gateway, where the uplink interface is an interface of the external network, and is used for performing VPN packet forwarding with a user edge CE router;
  • the forwarding policy includes: a VPN packet received from the virtual machine, where a next hop address is an address of a downlink interface of the CE router; The VPN packet received by the downlink interface of the CE router. The destination address is the address of the virtual machine.
  • the virtual network management apparatus is further configured to instruct the network node to create a routing information publishing module, and the virtual machine Routing information is sent to the routing information publishing module;
  • the routing information issuing module is configured to advertise the routing information of the virtual machine to the CE router, so that the CE router maintains an updated CE routing table, and the content packet recorded by the CE routing table
  • the VPN packet received from the external network, the next hop address is the address of the gateway uplink interface.
  • the virtual network management apparatus is specifically configured to instruct the network node to create a routing information publisher instance, where the routing information is The publisher instance configures a separate address space, and connects the routing information publisher instance to a routing agent, where the routing information publisher instance is configured to send the virtual to the corresponding router instance on the CE router by using a dynamic routing protocol. Machine routing information.
  • the virtual network management device is specifically configured to pass the routing information after the virtual machine is created, migrated, or revoked.
  • the publishing module issues updated routing information of the virtual machine to the CE router.
  • the virtual network management device is further configured to acquire updated router information, according to the updated router information, when a connection between the first subnet and the router is disconnected, or the router and the When the connection of the external network is disconnected, the gateway is revoked;
  • the virtual network management device is further configured to obtain updated virtual machine information, and according to the updated virtual machine information, when the connection between the virtual machine and the first subnet is disconnected, the gateway is revoked .
  • the data transmission method, the virtual network management device, and the data transmission system provided by the embodiments of the present invention acquire the router information, acquire the virtual machine information, acquire the virtual machine information, and obtain the virtual machine information according to the network identification information, the router information, and the virtual machine.
  • the information is judged.
  • a distributed gateway is created on the computing node, and the distribution is performed.
  • the gateway is configured to forward VPN packets through the distributed gateway. VPN packets do not need to rely on the existing centralized processing scheme for forwarding.
  • multiple virtual machines belonging to the same virtual network or different virtual networks on the same computing node may share the same distributed gateway.
  • a distributed gateway because it is only responsible for forwarding VPN packets of the virtual machine on the compute node, the workload is small, and the distributed gateway is sufficient to forward the VPN packets of these virtual machines efficiently, thus avoiding the VPN.
  • the congestion of the message reduces the communication delay.
  • a fourth aspect of the present application provides a gateway creation method, including: a virtual network management apparatus first determining a subnet in which a virtual machine VM established on a computing node is located.
  • the virtual network management device may query the stored IP address segment of each subnet by using the IP address of the VM to confirm the subnet where the VM is located.
  • the virtual network management device determines a gateway address corresponding to the subnet where the VM is located, a network identifier ID of the subnet where the VM is located, an IP address segment of the external network corresponding to the tenant to which the VM belongs, a network ID of the external network, and the The gateway address corresponding to the external network.
  • the virtual network management device determines an IP address of the external network and a MAC address corresponding to the IP address of the external network, and the IP address of the external network belongs to an IP address segment of the external network.
  • the IP address of the uplink interface of the gateway created by the tenant on different computing nodes belongs to the IP address segment of the external network. Therefore, after the virtual network device acquires the IP address segment of the external network, it is required to allocate an IP address of the external network and a MAC address corresponding to the IP address of the external network as the gateway from the IP address segment of the external network.
  • the address of the upstream interface. The allocation action may be performed by the virtual network device or by the cloud resource manager.
  • the virtual network device allocates an unoccupied IP address from the IP address segment of the external network. If the allocation action is performed by the cloud resource manager, the virtual network device requests the cloud resource manager to allocate an unoccupied IP address from the IP address segment of the external network and assign a MAC address corresponding to the IP address of the external network. The cloud resource manager sends the assigned IP address of the external network and the MAC address corresponding to the IP address of the external network to the virtual network device.
  • the virtual network management device sends the gateway address corresponding to the subnet where the VM is located, the IP address of the external network and the MAC address corresponding to the IP address of the external network to the computing node, and instructs the computing node to create a gateway.
  • the scenario of establishing a VM on one computing node since the scenario of establishing a VM on one computing node is involved here, it only involves establishing a corresponding gateway on the computing node, and the actual data transmission system is provided with multiple computing nodes, each of which runs on the computing node of the VM.
  • the gateways are all provided with corresponding gateways. These gateways are distributed to each computing node. Compared with the traditional centralized routers deployed on the network nodes, the processing efficiency of VPN packets is not affected. Limited to the processing power of the network node.
  • the gateway is configured with an uplink interface and a downlink interface, and the address of the uplink interface of the gateway includes an IP address of the external network and a MAC address corresponding to the IP address of the external network, and the uplink of the gateway
  • the port is used for communicating with the downlink interface of the CE router.
  • the address of the downlink interface of the CE router is the gateway address corresponding to the external network, and the address of the downlink interface of the gateway is the gateway address corresponding to the subnet where the VM is located.
  • the downlink interface is used to communicate with the subnet where the VM is located.
  • the virtual network management device configures a forwarding policy for the gateway according to the gateway address corresponding to the external network, the network ID of the subnet where the VM is located, and the network ID of the external network, where the forwarding policy indicates that the gateway sends the first
  • the VPN packet is converted into a second VPN packet, where the first VPN packet carries the network ID of the subnet where the VM is located, and the second VPN packet carries the network ID of the external network, and the forwarding policy further indicates the The gateway sends the second VPN packet to the downlink interface of the CE router through the uplink interface of the gateway.
  • the method further includes: acquiring, by the virtual network management device, N subnets The subnet information, the subnet information of each subnet includes a network identifier ID and an IP address segment, where N is an integer greater than 0, and the N subnets belong to the tenant; the virtual network management device obtains the gateway address corresponding to each subnet.
  • the IP address segment of the external network, the network ID of the external network, and the gateway address corresponding to the external network; the virtual network management device determines that the subnet in which the VM established on the computing node is located includes: the virtual network management device acquires the The IP address of the VM, and the subnet where the VM is located is determined according to the IP address of the VM.
  • the virtual management device transmits various types of information determined according to the IP address of the VM to the virtual network management device in advance by the cloud resource manager.
  • the method further includes: the virtual network management device is configured to advertise the routing information of the VM to the CE router, where the route is The information is used to instruct the CE router to send a message destined for the VM to the uplink interface of the gateway.
  • the gateway provided by the present invention is distributed to each computing node.
  • the CE router receives the packet sent by the public network, the CE router needs to confirm, according to the routing information, which gateway the packet is sent to. interface.
  • the routing information of the VM needs to be released to the CE router.
  • the routing information corresponding to the revoked VM or the migrated VM needs to be updated to the CE router.
  • the method further includes: the virtual network management device determines that all VMs belonging to the tenant on the computing node are revoked; and the virtual network management device instructs the computing node to revoke the gateway.
  • the revoking the gateway may save the physical resources of the computing node, and may also The IP address and MAC address of the external network assigned to the gateway are released. Because the address resources of the external network to which each tenant belongs are limited, the reasonable recovery of the allocated address resources of the external network helps to improve the utilization of the address resources of the external network. rate.
  • a virtual network management apparatus for creating a gateway on a computing node that newly created a VM.
  • the apparatus includes at least one module for performing the gateway creation method provided by any one of the fourth aspect or the fourth aspect.
  • a computing device comprising a processor and a memory.
  • the computing device can be a virtual network management device in a data transmission system on which software for implementing an SDN controller can be executed to enable the computing device to implement the functions of the SDN controller.
  • the computing device is configured to perform the gateway creation method provided by any one of the fourth aspect or the fourth aspect.
  • a data transmission system comprising a cloud resource manager, a virtual network management device provided by the fifth aspect or the sixth aspect, a CE router, and at least one computing node.
  • the cloud resource manager establishes a communication connection with the virtual network management device
  • the virtual network management device establishes a communication connection with each computing node
  • the CE router establishes a communication connection with each computing node.
  • the cloud resource manager is configured to use subnet information of N subnets, and the subnet information of each subnet includes a network ID and an IP address segment, where N is an integer greater than 0, and the N subnets belong to one tenant, each sub
  • the gateway address corresponding to the network, the IP address segment of the external network corresponding to the tenant, the network ID of the external network, and the gateway address corresponding to the external network are sent to the virtual network management device.
  • the virtual network management device is configured to determine an IP address of the VM created on the first computing node, the VM belongs to the tenant, determine a subnet where the VM is located according to the IP address of the VM, and determine a subnet corresponding to the VM.
  • the virtual network management device is further configured to send, to the computing node, a gateway address corresponding to the subnet where the VM is located, and an IP address of the external network and a MAC address corresponding to the IP address of the external network. And instructing the first computing node to create a gateway.
  • the gateway is configured with an uplink interface and a downlink interface, and the address of the uplink interface of the gateway includes a MAC address corresponding to an IP address of the external network and an IP address of the external network, and an uplink interface of the gateway is used for a downlink interface with the CE router.
  • the address of the downlink interface of the CE router is the gateway address corresponding to the external network
  • the address of the downlink interface of the gateway is the gateway address corresponding to the subnet where the VM is located, and the downlink interface of the gateway is used for the VM. Subnet communication.
  • the virtual network management device is further configured to generate a forwarding policy according to a gateway address corresponding to the external network, a network identifier ID of the subnet where the VM is located, and a network ID of the external network, where the forwarding policy indicates that the gateway sends the VM
  • the first VPN packet is converted into a second VPN packet, where the first VPN packet carries the network identifier of the subnet where the VM is located, and the second VPN packet carries the network ID of the external network, and the forwarding policy is used.
  • the gateway is also instructed to send the second VPN packet to the downlink interface of the CE router through the uplink interface of the gateway.
  • the first computing node is configured to create the gateway and receive the forwarding policy, and configure the forwarding policy for the gateway.
  • the virtual network management apparatus is further configured to: advertise routing information of the VM to the CE router, where the routing information is used to indicate that the CE router is to be a destination
  • the message of the VM is sent to the uplink interface of the gateway.
  • the data transmission system further includes a routing information issuing module, where the routing information issuing module is disposed in a computing node or a network node of the data transmission system;
  • the virtual network management device is further configured to generate routing information of the VM, where the routing information is used to indicate that the CE router sends a packet destined for the VM to an uplink interface of the gateway;
  • the routing information issuing module is configured to issue routing information of the VM to the CE router.
  • the virtual network management device is further configured to determine that all VMs belonging to the tenant on the computing node are revoked. Instructing the compute node to revoke the gateway.
  • a storage medium in which program code is stored, and when the program code is executed, the method provided by any one of the fourth aspect or the fourth aspect is executed.
  • the storage medium includes, but is not limited to, a flash memory (English: flash memory), a hard disk (English: hard disk drive, abbreviated as HDD) or a solid state drive (English: solid state drive, Abbreviation: SSD).
  • a ninth aspect of the present application provides a computer program product, which may be a software installation package, when the software installation package is executed, performing any one of the fourth aspect or the fourth aspect method.
  • FIG. 1 is a schematic diagram of a communication manner between virtual networks in a data center in the prior art
  • FIG. 2 is a schematic flowchart of a data transmission method according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic flowchart of a data transmission method according to Embodiment 2 of the present invention.
  • FIG. 4 is a schematic diagram of an SDN controller issuing routing information of a virtual machine through a routing information publishing module;
  • FIG. 5 is a schematic diagram of north-south communication of a direct connection network between a virtual machine and a communication peer according to Embodiment 2 of the present invention.
  • FIG. 6 is a schematic structural diagram of a virtual network management apparatus according to Embodiment 3 of the present invention.
  • FIG. 7 is a schematic structural diagram of a data transmission system according to Embodiment 4 of the present invention.
  • FIG. 8 is a schematic structural diagram of a data transmission system according to Embodiment 5 of the present invention.
  • FIG. 9 is a schematic structural diagram of a computing device according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of a virtual network management apparatus according to an embodiment of the present invention.
  • Embodiments of the present invention provide a data transmission method, which is applied to a cloud computing scenario, and provides a distributed solution for north-south communication of a direct connection network mode.
  • the method involves a cloud resource manager, a virtual network management device, a network node, a computing node, and a CE router.
  • the cloud resource manager is used for resource allocation and management, including virtual network creation, virtual machine creation, migration, and deletion.
  • the cloud resource manager may be an object with the same or similar functions provided by Openstack, or other cloud resource management platform.
  • the network node is used for transmitting, forwarding, and the like of the network data.
  • the forwarding function of the north-south communication data is mainly involved.
  • a virtual machine is created in the computing node, and the virtual machine is a host in the virtual network, and is a main body for north-south communication with the communication peer.
  • the virtual network management device is the main body for managing the virtual network.
  • the virtual network management device acquires the topology of the entire virtual network from the information reported by the network node and the computing node, including between the virtual machine and the router in the virtual network, and between the router and the data center external network.
  • the connection state which manages the virtual network according to the topology of the virtual network.
  • the data packet of the north-south communication of the virtual network is sent from the data center, then enters the VPN through the CE router, and finally sends to the communication pair. end.
  • the data packets sent by the communication peer to the north-south communication of the virtual network in the data center are sent to the CE router through the VPN and forwarded to the data center through the CE router.
  • the data transmission method provided by the embodiment of the present invention is applied to a virtual network management apparatus. Referring to FIG. 2, the method includes the following steps:
  • the virtual network management device acquires network identification information of the virtual network.
  • the network identification information includes the network ID of the virtual network and the subnet information of the virtual network.
  • the subnet information is used to identify the subnet of the virtual network.
  • the subnet information is used to identify each subnet included in the virtual network, including the first subnet. Specifically, different subnets are identified by their respective Internet Protocol (English Protocol: Internet Protocol, IP address) and the corresponding subnet mask. Of course, the virtual network can also include only one subnet, the first subnet.
  • the virtual network management device is a software defined network (English name: Software Defined Network, English abbreviation: SDN) controller.
  • SDN Software Defined Network
  • the embodiment of the present invention is described by taking an application scenario in which the virtual network management device is an SDN controller as an example. After the virtual network is created, the network node sends the network identification information of the virtual network to the SDN controller.
  • the router information is used to indicate the connection status of the router, including which subnet connections of the router and the virtual network, and whether the router is connected to the external network of the data center.
  • a virtual network consists of two subnets. If both subnets are connected to a router, east-west communication can take place between the two subnets. If the router is further connected to an external network, any of the two subnets can communicate north-south.
  • the network node is instructed to create a router to provide a routing service for the created virtual network.
  • the cloud resource manager configures it to connect the router to some or all of the subnets in the virtual network, or to further connect the router to the external network of the data center.
  • the network node sends the router information to the SDN controller according to the connection state of the router.
  • the cloud resource manager After the cloud resource manager creates the virtual network, instructs the compute node to create a virtual machine and connect the virtual machine to a subnet of the virtual network.
  • the subnet connected to the virtual machine is the first subnet will be described as an example.
  • the compute node After the virtual machine is connected to the first subnet, the compute node sends the virtual machine information to the SDN controller.
  • the network identification information, the router information, and the virtual machine information are sent to the virtual machine.
  • Compute node to instruct the compute node to create a distributed gateway and configure the distributed gateway.
  • the distributed gateway is configured to forward the VPN packets of the virtual private network.
  • the VPN packet is a data packet when the virtual machine performs the north-south communication in the direct connection network mode.
  • steps 201-204 are respectively performed for different computing nodes, and a distributed gateway is established on multiple computing nodes to forward virtual machine VPN packets on different computing nodes. .
  • the SDN controller enters the network identification information, router information, and virtual machine information of the virtual network. It is determined that if the first subnet is connected to the router and the router is connected to the external network, it indicates that the virtual machine has a north-south communication requirement for direct connection network mode, and a distributed gateway is established at this time.
  • the distributed gateway is configured, including connecting the first subnet with the distributed gateway, and connecting the distributed gateway to the external network.
  • the virtual machine can send a VPN packet to the communication peer through the distributed gateway, or receive the VPN packet sent by the communication peer through the distributed gateway.
  • the SDN controller obtains the network identification information of the virtual network from the cloud resource manager, acquires the router information from the network node, acquires the virtual machine information from the computing node, and according to the network identification information, The router information and the virtual machine information are judged.
  • a distributed gateway is created on the computing node. The distributed gateway is configured to forward VPN packets through the distributed gateway. VPN packets do not need to rely on the existing centralized processing scheme for forwarding.
  • multiple virtual machines belonging to the same virtual network or different virtual networks on the same computing node may share the same distributed gateway.
  • a distributed gateway because it is only responsible for forwarding VPN packets of the virtual machine on the compute node, the workload is small, and the distributed gateway is sufficient to forward the VPN packets of these virtual machines efficiently, thus avoiding the VPN.
  • the congestion of the message reduces the communication delay.
  • the second embodiment of the present invention provides a data transmission method. Referring to FIG. 3, the following steps are included:
  • the cloud resource manager creates a virtual network, and sends network identification information of the virtual network to the SDN controller.
  • the network identification information includes the network ID of the virtual network and the subnet information of the virtual network.
  • the subnet information is used to identify a subnet of the virtual network, and the subnet of the virtual network includes the first subnet.
  • the network ID may be a virtual local area network (English name: Virtual Local Area Network, English abbreviation: VLAN) ID or a virtual extensible local area network (English full name: Virtual Extensible Local Area Network, English abbreviation: VxLAN) ID.
  • the subnet information of the virtual network is used to indicate the subnets included in the virtual network, and may specifically include the IP addresses of the subnets. And the subnet mask.
  • the cloud resource manager instructs the network node to create a router and configure a connection state of the router.
  • the configuration of the connection state of the router means that the router is connected to some or all of the subnets in the virtual network, or the router can be further connected to the external network.
  • connecting the router to the first subnet means adding a subnet interface to the router.
  • the IP address of the subnet interface is the gateway address of the first subnet.
  • the first subnet is any subnet of the virtual network.
  • connecting a router to an external network means adding an external network interface to the router.
  • a name space may be further created for the router. If the virtual network only needs to communicate directly with the north-south network, there is no need to create a namespace for the router.
  • the network node sends the router information to the SDN controller.
  • the router information is used to indicate the connection status of the router. It is specifically used to indicate which subnets in the virtual network the router is connected to and whether it is connected to the external network.
  • the cloud resource manager instructs the computing node to create a virtual machine and connect the virtual machine to a subnet of the virtual network.
  • the computing node sends the virtual machine information to the SDN controller.
  • the virtual machine information is used to indicate the subnet to which the virtual machine is connected.
  • the SDN controller acquires network identification information, router information, and virtual machine information of the virtual network, where the information describes the topology of the virtual network, including the connection relationship between the subnet and the router in the virtual network, and the sub-network.
  • the virtual machine connected to the network and the connection status between the virtual network and the external network.
  • the SDN controller determines that the subnet connected to the virtual machine is the first subnet, and the first subnet is connected to the router, and the router is connected to the external network, sending the network identification information, the router information, and the virtual machine information to The compute node where the virtual machine resides to instruct the compute node to create a distributed gateway.
  • the distributed gateway is used to forward the VPN packets of the virtual private network.
  • the VPN packets are the data packets when the virtual machine performs the north-south communication in the direct connection network mode.
  • the SDN controller judges according to the topology of the virtual network to determine whether to establish a distributed network. turn off. Specifically, if the router is not connected to the external network, that is, the external network interface is not configured for the router, indicating that the virtual machine does not have the requirement of direct-to-network communication in the north-south direction, there is no need to establish a distributed gateway. If the router is connected to the external network, it indicates that the virtual machine has a north-south communication requirement for the direct connection network mode, and a distributed gateway is established.
  • the SDN controller configures the distributed gateway.
  • the distributed gateway can forward VPN packets.
  • the configuration of the distributed gateway includes three points, adding a downlink interface for the distributed gateway, adding an uplink interface for the distributed gateway, and setting a forwarding policy for the distributed gateway.
  • the downlink interface of the distributed gateway is the interface between the distributed gateway and the virtual network subnet. This embodiment is only for the first subnet.
  • the SDN controller determines the network segment to which the first subnet belongs within the virtual network according to the network identification information, and then adds a downlink interface to the distributed gateway, where the IP address of the downlink interface is the gateway address of the first subnet.
  • the uplink interface of the distributed gateway is the interface between the distributed gateway and the CE router.
  • the SDN controller adds an uplink interface to the distributed gateway, and the uplink interface is an interface of the external network, and the downlink interface of the CE router belongs to the same external network, so that the distributed gateway can forward the VPN packet with the CE router.
  • a forwarding policy of a distributed gateway that is, a rule for a distributed gateway to forward VPN packets.
  • the forwarding policy may be implemented in the form of a routing table. Or implemented in the form of an OpenFlow flow table.
  • the OpenFlow-based forwarding rules are more flexible and applicable.
  • the compute nodes do not need to support the Name Space and do not need IP routing capabilities, thus reducing the requirements on computing nodes.
  • the SDN controller sets a forwarding policy for the distributed gateway according to the network identification information, and the forwarding policy includes: the VPN packet received from the virtual machine, the next hop address is the address of the downlink interface of the CE router; and the downlink is from the CE router.
  • the destination address is the address of the virtual machine.
  • the SDN controller instructs the network node to create a routing information publishing module, and dynamically advertises the routing information of the virtual machine to the CE router through the routing information publishing module.
  • step 307 after receiving the VPN packet, the distributed gateway completes the forwarding of the VPN packet from the distributed gateway to the CE router according to the forwarding policy of the distributed gateway.
  • the SDN controller instructs the network node to create a routing information publishing module, and dynamically sends the routing information of the virtual machine to the routing information publishing module, and the routing information publishing module issues the routing information of the virtual machine to the CE router to facilitate the CE router.
  • the content of the table record includes the VPN packet received from the external network, and the next hop address is the address of the uplink interface of the distributed gateway.
  • the CE router After receiving the VPN packet sent by the communication peer, the CE router forwards the VPN packet from the CE router to the distributed gateway according to the CE routing table.
  • the routing information publishing module includes a routing agent (English name: Routing Agent) and a routing information publisher instance.
  • the network node is instructed to create a routing information publishing module, which is specifically to create a routing information publisher instance, configure a separate address space for the routing information publisher instance, and connect the routing information publisher instance with the routing agent.
  • the routing agent is configured to communicate with the SDN controller to obtain routing information of the virtual machine.
  • the routing information of the virtual machine obtained by the routing agent is encapsulated by the routing information publisher instance according to the dynamic routing protocol and then advertised to the CE router.
  • the dynamic routing protocol may be a Border Gateway Protocol (English name: Border Gateway Protocol, English abbreviation: BGP).
  • a routing information publisher instance can advertise routing information of multiple virtual machines on different subnets in the virtual network to the CE router.
  • the routing information of the virtual machine is dynamically advertised to the CE router.
  • the routing information of the virtual machine is updated, the routing information of the updated virtual machine is released to the CE router.
  • the SDN controller issues the routing information of the updated virtual machine to the CE router through the routing information issuing module.
  • the routing information publishing module may include multiple routing information publisher instances, and each routing information publisher instance configures an independent address space.
  • the CE router creates multiple router instances through the VPN routing and forwarding (English full name: VPN Routing and Forwarding, English abbreviation: VRF) function.
  • the router instance corresponds to the routing information publisher instance.
  • the router instance 1 corresponds to the routing information publisher instance 1
  • the router instance 2 corresponds to the routing information publisher instance 2.
  • the routing information publisher instance 1 will be able to issue routing information of the virtual machines in the N virtual networks to the router instance 1, where N is an integer greater than or equal to 1.
  • the N virtual networks share router instance 1, or router instance 1 provides routing services for the N virtual networks.
  • the routing information publisher instance 2 can also provide routing services for at least one virtual network.
  • a tenant is usually configured with a router instance that provides routing services for at least one virtual network of the tenant. Different router instances provide routing services for virtual networks of different tenants.
  • the virtual machine communicates with the communication peer through the distributed router and the CE router in a direct connection network manner.
  • VPN packet forwarding process is illustrated when the virtual machine communicates with the communication peer directly in the north-south direction.
  • IP address of the virtual machine is 192.168.100.6, and the address of the media access control (English name: Media Access Control, English abbreviation: MAC) is 1122-3344-6666.
  • the downlink interface of the distributed gateway that is, the gateway of the first subnet is 192.168.100.1, and the MAC address is 1122-3344-5555.
  • the uplink interface of the distributed gateway that is, the interface between the distributed gateway and the CE router, the IP address is 192.168.120.3, and the MAC address is 1122-3344-3333.
  • the downlink interface of the CE router has an IP address of 192.168.120.1 and a MAC address of 1122-3344-1111.
  • the IP address of the communication peer is 192.168.200.35.
  • the communication peer and the CE router are connected through a VPN that traverses the public network.
  • the virtual machine requests the downlink interface MAC address of the distributed gateway through the address resolution protocol (English name: Address Resolution Protocol, English abbreviation: ARP). After the MAC address of the downlink interface of the distributed gateway is obtained, the VPN packet is sent to the distributed gateway.
  • the content of the VPN packet is shown in Table 1.
  • the VLAN ID of the virtual network is 500 and the VLAN ID of the external network is 100.
  • the distributed gateway After receiving the VPN data packet sent by the virtual machine, the distributed gateway queries the forwarding policy (the routing table of the distributed gateway or the OpenFlow flow table) according to the destination IP address, and determines that the next hop address is the address of the downlink interface of the CE router.
  • the source MAC address is modified to the uplink interface MAC address of the distributed gateway, and the destination MAC address is modified to be the downlink interface MAC address of the CE router.
  • the VPN packet is sent to the downlink interface of the CE router through the uplink interface of the distributed gateway.
  • the distributed gateway forwards the VPN packets sent by the virtual machine from the virtual network (VLAN ID 500) to the external network (VLAN ID 100), and finally passes through the public network through the VPN and is sent to the communication peer.
  • the next hop address is determined as the address of the uplink interface of the distributed gateway according to the CE routing table, and the source MAC address is modified to the downlink interface of the CE router.
  • the MAC address is changed to the uplink interface MAC address of the distributed gateway, and then the VPN packet is sent to the uplink interface of the distributed gateway through the downlink interface of the CE router.
  • the distributed gateway After receiving the VPN data packet sent by the CE router, the distributed gateway determines the virtual network subnet to which the virtual machine is connected according to the destination IP address, and modifies the source MAC address to the downlink interface MAC address of the distributed gateway, and the destination MAC address is changed to the virtual machine MAC address. At the same time, the VLAN ID of the external network is changed to the VLAN ID of the virtual network, and then the VPN packet is sent to the virtual machine through the downlink interface of the distributed gateway.
  • the SDN controller obtains updated router information from the network node.
  • the network node reports the updated router information to the SDN controller.
  • the SDN controller cancels the distributed gateway.
  • the SDN controller acquires updated virtual machine information from the computing node.
  • connection status of the virtual machine changes, for example, the connection between the virtual machine and the first subnet is disconnected, including the creation of a new virtual machine, or the revocation and migration of the existing virtual machine.
  • the computing node reports the updated virtual machine information to the SDN controller.
  • the distributed gateway is revoked.
  • the virtual machine is disconnected from the first subnet, including the virtual machine revocation and migration.
  • the SDN controller revokes the distributed gateway. .
  • the distributed gateway can be revoked.
  • a distributed gateway is created only on the computing nodes that need to perform direct-connection network mode north-south communication, so as to reduce the scale of the external network as much as possible, and save the hardware and software resources of the computing nodes.
  • the SDN controller obtains the network identification information of the virtual network from the cloud resource manager, acquires the router information from the network node, acquires the virtual machine information from the computing node, and according to the network identification information, The router information and the virtual machine information are judged.
  • a distributed gateway is created on the computing node, and The distributed gateway is configured to forward VPN packets through the distributed gateway. VPN packets do not need to rely on the existing centralized processing scheme for forwarding.
  • multiple virtual machines belonging to the same virtual network or different virtual networks on the same computing node may share the same distributed gateway.
  • a distributed gateway because it is only responsible for forwarding VPN packets of the virtual machine on the compute node, the workload is small, and the distributed gateway is sufficient to forward the VPN packets of these virtual machines efficiently, thus avoiding the VPN.
  • the congestion of the message reduces the communication delay.
  • the third embodiment of the present invention provides a virtual network management apparatus for performing the functions performed by the SDN controller in the foregoing embodiment.
  • the virtual network management device 600 includes:
  • the virtual network management module 601 is configured to obtain network identification information of the virtual network, where the network identification information includes subnet information of the virtual network, the subnet information is used to identify a subnet of the virtual network, and the subnet of the virtual network includes the first subnet.
  • the network node management module 602 is configured to obtain router information, where the router information is used to indicate a connection status between the router and the subnet of the virtual network, and a connection status between the router and the external network.
  • the computing node management module 603 is configured to obtain virtual machine information, where the virtual machine information is used to indicate virtual The subnet to which the machine is connected.
  • the computing node management module 603 determines that the subnet to which the virtual machine is connected is the first subnet, and the first subnet is connected to the router, and the router is connected to the external network, the network identification information, the router information, and the virtual machine information are sent to The computing node where the virtual machine is located indicates that the computing node creates a gateway and configures the gateway.
  • the gateway is used to forward the VPN packets of the virtual private network.
  • the computing node management module 603 is specifically configured to:
  • An uplink interface is added to the gateway, and the uplink interface is an interface of the external network, and is used for forwarding VPN packets with the user edge CE router.
  • the forwarding policy is set for the gateway according to the network identifier information.
  • the forwarding policy includes: the VPN packet received from the virtual machine, the next hop address is the address of the downlink interface of the CE router, and the VPN packet received from the downlink interface of the CE router.
  • the destination address is the address of the virtual machine.
  • the network node management module 602 is further configured to create a routing information publishing module, and advertise the routing information of the virtual machine to the CE router by using the routing information publishing module, so that the CE router maintains and updates the CE routing table, and the content of the CE routing table records.
  • the next hop address is the address of the gateway uplink interface.
  • the network node management module 602 is specifically configured to create a routing information publisher instance, configure an independent address space for the routing information publisher instance, and connect the routing information publisher instance to the routing proxy, and use the routing information publisher instance.
  • the routing information of the virtual machine is sent to the corresponding router instance on the CE router through the dynamic routing protocol.
  • the network node management module 602 is configured to: after the virtual machine is created, migrated, or revoked, distribute the routing information of the updated virtual machine to the CE router by using the routing information publishing module.
  • the network node management module 602 is further configured to obtain updated router information.
  • the computing node management module 603 is further configured to revoke the gateway when the connection between the first subnet and the router is disconnected, or when the connection between the router and the external network is disconnected according to the updated router information.
  • the computing node management module 603 is further configured to obtain updated virtual machine information from the computing node.
  • the computing node management module 603 is further configured to revoke the gateway when the connection between the virtual machine and the first subnet is disconnected according to the updated virtual machine information.
  • the virtual network management apparatus obtains the network identifier information of the virtual network from the cloud resource manager, acquires the router information from the network node, acquires the virtual machine information from the computing node, and obtains the virtual machine information according to the network identifier information and the router information. Determining with the virtual machine information, when it is determined that the subnet to which the virtual machine is connected is the first subnet, the first subnet is connected to the router, and the router is connected to the external network of the data center, a distributed gateway is created on the computing node, and The distributed gateway is configured to forward VPN packets through the distributed gateway. VPN packets do not need to rely on the existing centralized processing scheme for forwarding.
  • multiple virtual machines belonging to the same virtual network or different virtual networks on the same computing node may share the same distributed gateway.
  • a distributed gateway because it is only responsible for forwarding VPN packets of the virtual machine on the compute node, the workload is small, and the distributed gateway is sufficient to forward the VPN packets of these virtual machines efficiently, thus avoiding the VPN.
  • the congestion of the message reduces the communication delay.
  • Embodiment 4 of the present invention provides a data transmission system.
  • the data transmission system 70 includes: a cloud resource manager 701, a virtual network management device 702, a network node 703, and a computing node 704, to complete the embodiment.
  • the functions corresponding to the execution entities in the second embodiment implement the data transmission method provided in the second embodiment.
  • the cloud resource manager 701 is configured to create a virtual network, and send network identifier information of the virtual network to the virtual network management device 702.
  • the network identifier information includes subnet information of the virtual network, and the subnet information is used to identify the virtual network.
  • Subnet the subnet of the virtual network includes the first subnet.
  • the cloud resource manager 701 is further configured to instruct the network node 703 to create a router, and configure a connection state between the router and a subnet of the virtual network, and a connection state between the router and the external network.
  • the network node 703 is configured to send the router information to the virtual network management device 702, where the router information is used to indicate the connection status between the router and the subnet of the virtual network, and the connection status between the router and the external network.
  • the cloud resource manager 701 is further configured to instruct the computing node 704 to create a virtual machine and connect the virtual machine to a subnet of the virtual network.
  • the computing node 704 is further configured to send the virtual machine information to the virtual network management device 702, where the virtual machine information is used to indicate the subnet to which the virtual machine is connected.
  • the virtual network management device 702 determines that the subnet to which the virtual machine is connected is the first subnet, and the first subnet is connected to the router, and the router is connected to the external network, the network identification information, the router information, and the virtual machine information are sent to The computing node 704, where the virtual machine is located, instructs the computing node 704 to create a gateway and configure the gateway for forwarding the virtual private network VPN packet.
  • the virtual network management device 702 is specifically configured to:
  • An uplink interface is added to the gateway, and the uplink interface is an interface of the external network, and is used for forwarding VPN packets with the user edge CE router.
  • the forwarding policy is set for the gateway according to the network identifier information.
  • the forwarding policy includes: the VPN packet received from the virtual machine, the next hop address is the address of the downlink interface of the CE router, and the VPN packet received from the downlink interface of the CE router.
  • the destination address is the address of the virtual machine.
  • the virtual network management device 702 is further configured to instruct the network node 703 to create a routing information publishing module, and send the routing information of the virtual machine to the routing information publishing module.
  • the routing information issuance module is configured to advertise the routing information of the virtual machine to the CE router, so that the CE router maintains and updates the CE routing table.
  • the content recorded in the CE routing table includes the VPN packet received from the external network, and the next hop address is the gateway. The address of the upstream interface.
  • the virtual network management device 702 is specifically configured to instruct the network node 703 to create a routing information publisher instance, configure an independent address space for the routing information publisher instance, and connect the routing information publisher instance to the routing agent, and the routing information.
  • the publisher instance is used to send routing information of the virtual machine to the corresponding router instance on the CE router through the dynamic routing protocol.
  • the virtual network management device 702 is specifically configured to: after the virtual machine is created, migrated, or revoked, distribute the routing information of the updated virtual machine to the CE router by using the routing information publishing module.
  • the virtual network management device 702 is further configured to obtain updated router information, when the connection between the first subnet and the router is disconnected, or the connection between the router and the external network is disconnected according to the updated router information. , revoke the gateway.
  • the virtual network management device 702 is further configured to obtain updated virtual machine information, and according to the updated virtual machine information, when the connection between the virtual machine and the first subnet is disconnected, the gateway is revoked.
  • the virtual network management device acquires the router information from the network node by acquiring the network identification information of the virtual network from the cloud resource manager.
  • the computing node obtains the virtual machine information, and determines according to the network identification information, the router information, and the virtual machine information.
  • the subnet to which the virtual machine is connected is the first subnet
  • the first subnet is connected to the router, and the router and the data center are connected.
  • a distributed gateway is created on the compute node, and the distributed gateway is configured to forward VPN packets through the distributed gateway. VPN packets do not need to rely on the existing centralized processing scheme for forwarding.
  • multiple virtual machines belonging to the same virtual network or different virtual networks on the same computing node may share the same distributed gateway.
  • a distributed gateway because it is only responsible for forwarding VPN packets of the virtual machine on the compute node, the workload is small, and the distributed gateway is sufficient to forward the VPN packets of these virtual machines efficiently, thus avoiding the VPN.
  • the congestion of the message reduces the communication delay.
  • the fifth embodiment of the present invention provides a gateway creation method, which is applied to the data transmission system shown in FIG. 8, and the method includes:
  • Step 802 The cloud resource manager sends the subnet information of the N subnets to the SDN controller, where N is an integer greater than 0.
  • N subnets through the Cloud Resource Manager. These N subnets can be VLAN subnets or VxLAN subnets or other types of subnets.
  • the subnet information of each subnet includes: the network ID corresponding to the subnet and the IP address segment of the subnet.
  • the subnet information of the first subnet includes: VLAN ID 500, 192.168.100.0/24.
  • Step 804 The cloud resource manager sends a gateway address corresponding to each subnet to the SDN controller.
  • the gateway address specifically includes: the IP address and MAC address of the gateway.
  • the gateway address of the first subnet includes an IP address of 192.168.100.1 and a MAC address of 1122-3344-5555.
  • Step 806 The cloud resource manager sends the IP address segment of the external network corresponding to the N subnets, the network ID of the external network, and the gateway address corresponding to the external network to the SDN controller.
  • the IP address segment of the external network includes: 192.168.120.0/24, and the network ID of the external network is VLAN ID 100, and the gateway address corresponding to the external network includes: IP address 192.168.10120.1, MAC address 1122-3344-1111 .
  • the external network may actually be one of a plurality of external networks allocated by the VPN for the data transmission system.
  • Each tenant of the data transmission system is assigned an IP address segment as the external network of the tenant.
  • the external network is used to route between the distributed gateway and the CE router to which the tenant belongs Message.
  • steps 804 and 806 may be interchanged, or step 802, step 804, step 806 may be combined into the same step, or step 804 and step 806 may be combined into the same step.
  • the cloud resource manager sends various types of information to the SDN controller, the tenant identifier needs to be sent.
  • the IP address segment of the external network corresponding to the subnet to which the same tenant belongs and the gateway address corresponding to the external network are the same.
  • the gateway address corresponding to the external network of a tenant is actually the address of the corresponding downlink interface of the tenant on the CE router.
  • the subnet information of the subnet corresponding to each tenant is stored in the SDN controller, the gateway address corresponding to each subnet, the IP address segment of the external network, the network ID of the external network, and the gateway address corresponding to the external network. .
  • the subnet information 11 includes VLAN ID 500, 192.168.10 0.0/24; the gateway address 11 of the subnet is the IP address 192.168.100.1, the MAC address 1122-3344-5555; and the IP address segment 1 of the external network is 192.168.120.0. /24;
  • the network ID of the external network is VLAN ID 100; the gateway address 1 of the external network is IP address 192.168.10 120.1, MAC address 1122-3344-1111.
  • Step 808 the cloud resource manager instructs a computing node to create a VM.
  • the VM-1 is created on the computing node 1 in step 808.
  • the IP address of the VM-1 is 192.168.100.6, and the MAC address is 1122-3344-6666. This VM-1 belongs to tenant 1.
  • the cloud resource manager sends the IP address and MAC address of the VM to be created to the computing node, and also sends the subnet information corresponding to the subnet where the VM is located to the computing node.
  • step 810 the computing node sends a VM creation message to the SDN controller.
  • the VM creation message instructs the SDN controller to create the VM on the compute node.
  • the computing node 1 After the computing node 1 creates a successful VM-1, it notifies that the SDN controller VM-1 is created, and the SDN controller acquires the IP address of the VM-1.
  • the IP address of the VM-1 may be specifically carried in the VM creation message sent by the computing node 1 to the SDN controller.
  • Step 812 The SDN controller determines information corresponding to the subnet where the VM is located, including a gateway address of the subnet, an IP address segment of the external network, a network ID of the external network, and a gateway address of the external network.
  • Step 814 the SDN controller determines an IP address of the external network and a MAC address corresponding to the IP address.
  • the SDN controller allocates an IP address from an IP address segment of the external network and assigns a MAC address corresponding to the IP address.
  • the SDN controller requests the cloud resource manager to allocate an IP address from an IP address segment of the external network and assign a MAC address corresponding to the IP address.
  • the SDN controller knows that the IP address of VM-1 is 192.168.100.6.
  • the SDN controller determines, according to the IP address of the VM-1, the information corresponding to the subnet where the VM-1 is located, including: subnet information VLAN ID 500, 192.168.10 0.0/24; subnet gateway address IP address 192.168 .100.1, MAC address 1122-3344-5555; IP address segment of external network 192.168.120.0/24; network ID of external network VLAN ID100; IP address of gateway of external network 192.168.10 120.1, MAC address 1122-3344-1111 .
  • the SDN controller allocates an IP address from 192.168.120.0/24 as the IP address of the uplink interface of the distributed gateway created on the subsequent computing node 1, for example, 192.168.120.3.
  • the SDN controller also assigns a MAC address corresponding to the IP address, for example, 1122-3344-3333, as the MAC address of the uplink interface of the distributed network created on the compute node 1.
  • the cloud resource manager uniformly manages the IP address and the MAC address in the entire data transmission system, and in step 814, the SDN controller requests the cloud resource manager to be from 192.168.120.0/24. Assign an IP address and assign a MAC address corresponding to the IP address.
  • Step 816 The computing node receives the gateway address of the subnet corresponding to the subnet where the VM is located, the IP address of the external network, and the MAC address corresponding to the IP address.
  • the information received in step 816 is used to create a distributed gateway on the compute node.
  • the gateway address of the subnet is used to create a downlink interface corresponding to the subnet where the VM is located.
  • the IP address and MAC address of the external network are used to create an uplink interface of the distributed gateway.
  • Step 818 The computing node establishes a distributed gateway according to the gateway address of the subnet corresponding to the subnet where the VM is located, the IP address and MAC address of the external network.
  • Step 820 The SDN controller generates a forwarding policy of the distributed gateway, and sends the forwarding policy to the computing node, so that the computing node configures the distributed gateway by using the forwarding policy.
  • the SDN controller configures a forwarding policy for the distributed gateway according to the gateway address corresponding to the external network, the network ID of the subnet where the VM is located, and the network ID of the external network.
  • the distributed gateway sends the packet sent by the subnet of the VM to the external network
  • the packet spans the subnet, that is, the network ID carried by the packet is from the subnet where the VM is located.
  • the network ID is converted to the network ID of the external network.
  • the network identification ID of the subnet where the VM is located and the network ID of the external network are used to set the forwarding policy.
  • the forwarding policy includes: converting the first VPN packet sent by the VM into the second VPN packet, where the first VPN packet carries the network identifier ID of the subnet where the VM is located, where the second VPN packet carries the The network ID of the external network.
  • the forwarding policy needs to indicate the routing path of the packet.
  • the MAC address of the external network and the gateway address of the external network are used to set the forwarding policy in the distributed gateway, where the forwarding policy indicates that the packet sent by the VM is sent to the external network through the uplink interface of the distributed gateway.
  • the gateway address that is, the packet sent by the VM-1, is sent to the downlink interface of the CE router corresponding to the tenant 1 through the uplink interface of the distributed gateway.
  • the forwarding policy can be implemented in the form of a flow table or a routing table.
  • the flow table needs to modify the source MAC address of the packet sent by the VM to the MAC address of the uplink interface of the distributed network, and modify the destination MAC address of the packet to correspond to the CE router.
  • the MAC address of the downlink interface corresponding to the tenant to which the VM belongs is also changed to the network ID of the subnet to which the VM belongs.
  • the SDN controller knows the IP address of the VM, and the SDN controller also knows the IP address and MAC address of the uplink interface of the distributed gateway, so the SDN controller needs to issue the VM to the CE router. Routing information to indicate that the CE router sends a packet destined for the VM to the uplink interface of the distributed gateway.
  • Step 822 The SDN controller sends the routing information to the CE router through the routing information issuing module, where the routing information indicates that the CE router sends the packet destined for the VM to the uplink interface of the distributed gateway.
  • the routing information publishing module can be deployed inside the SDN controller or deployed on any computing node.
  • the routing information may specifically indicate that the next hop of the packet sent to the VM is the IP address of the uplink interface of the distributed gateway.
  • routing information issuing module For a specific implementation manner of the routing information issuing module, refer to the portion corresponding to FIG. 4 in the foregoing embodiment.
  • Step 822 is performed at any time after step 814.
  • the process of establishing the distributed gateway and the route issuing process to the CE router may also be performed simultaneously.
  • the SDN controller may also release the routing information of the migrated VM to the CE router through the routing information issuing module, or the VM is revoked after the VM is revoked. Next, the SDN controller notifies the CE router to delete the routing information of the revoked VM.
  • Step 824 the SDN controller determines that all VMs belonging to the tenant to which the VM belongs on the computing node are revoked, and instructs the computing node to revoke the distributed gateway.
  • the SDN controller After the first VM established by a tenant on a computing node is described in the foregoing steps 808 to 818, the SDN controller establishes a distributed gateway for the tenant on the computing node. In practice, if the data transmission system includes other tenants, and other tenants also establish VMs on the computing node, the SDN controller also needs to establish a distribution for each tenant of the VM established on the computing node. Gateway.
  • the SDN controller manages which computing node each VM to which each tenant belongs is located in the data transmission system. Therefore, when the SDN controller confirms that all of the VMs of a tenant on a certain compute node are revoked, the SDN controller instructs the compute node to revoke the previously established distributed gateway.
  • step 824 has no timing relationship with the foregoing steps, that is, the SDN controller can also monitor each tenant on each computing node while establishing a distributed gateway for the newly created VM.
  • the operation of the VM once it is found that all the VMs of a certain tenant on a certain computing node are revoked, the SDN controller instructs the computing node to revoke the previously established distributed gateway.
  • step 824 is such that if all VMs belonging to a certain tenant on a certain computing node are revoked, the distributed gateway belonging to the tenant on the computing node may be deleted, the resources of the computing node are released, and the computing node is upgraded. The efficiency of the use of resources. At the same time, the IP address and MAC address of the external network corresponding to the tenant occupied by the distributed gateway can be released, and the use efficiency of the address of the external network is improved.
  • the method provided by the embodiment of the present invention creates a distributed gateway on the computing node and configures the distributed gateway to forward the VPN packet through the distributed gateway.
  • the VPN packets do not need to be forwarded according to the existing centralized processing scheme, which improves the processing efficiency of VPN packets.
  • the processing procedure of the VPN packet sent by the VM and the processing procedure of the VM receiving the VPN packet are referred to the embodiment corresponding to FIG. 5 described above.
  • the virtual network management device or SDN controller in the aforementioned figures may be implemented by computing device 1000.
  • the schematic diagram of the organization of the computing device 1000 includes a processor 1002, a memory 1004, and a bus 1008 and a communication interface 1006.
  • the processor 1002, the memory 1004, and the communication interface 1006 can implement communication connection with each other through the bus 1008, and can also implement communication by other means such as wireless transmission.
  • the processor 1002 can be a central processing unit (English: central processing unit, abbreviation: CPU).
  • the memory 1004 may include a volatile memory (English: volatile memory), such as random access memory (English: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English: non-volatile memory) For example, a read-only memory (English: read-only memory, abbreviated as ROM), a flash memory, an HDD or an SSD; the memory 204 may also include a combination of the above types of memories.
  • the program code for implementing the portion of the method provided by the SDN controller in the method of FIG. 8 of the present application is stored in the memory 1004 and executed by the processor 1002.
  • Computing device 1000 communicates with other nodes in the data transport network and cloud resource management via communication interface 1006.
  • the embodiment of the present invention provides a virtual network management apparatus for performing the functions performed by the SDN controller in the foregoing embodiment.
  • the virtual network management device 1200 includes a processing module 1202, a transmitting module 1204, and a receiving module 1206.
  • the virtual network management device 1200 can be implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (abbreviated as PLD).
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above PLD may be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), a field programmable gate array (English: field programmable gate array, abbreviated: FPGA), general array logic (English: general array logic, Abbreviation: GAL) or any combination thereof.
  • the receiving module 1206 is configured to receive subnet information of N subnets sent by the cloud resource manager, a gateway address corresponding to each subnet, an IP address segment of the external network corresponding to the N subnets, a network ID of the external network, and The gateway address corresponding to the external network.
  • the receiving module 1206 will receive the subnet information of the N subnets, the gateway address corresponding to each subnet, the IP address segment of the external network corresponding to the N subnets, the network ID of the external network, and the gateway address corresponding to the external network. Send to processing module 1202.
  • the receiving module 1206 is further configured to receive a VM creation message.
  • the processing module 1202 is configured to determine information corresponding to the subnet where the VM is located, including a gateway address of the subnet, an IP address segment of the external network, a network ID of the external network, a gateway address of the external network, and determine an IP address of the external network. And the MAC address corresponding to the IP address.
  • the sending module 1204 is further configured to send the gateway address of the subnet corresponding to the subnet where the VM is located, the IP address of the external network, and the MAC address corresponding to the IP address to the computing node that creates the VM.
  • the processing module 1202 is further configured to generate, by the SDN controller, a forwarding policy according to a gateway address corresponding to the external network, a network identifier ID of the subnet where the VM is located, and a network ID of the external network.
  • the sending module 1204 is further configured to send the forwarding policy to the computing node.
  • the processing module 1202 is further configured to generate routing information of the VM, where the routing information is used to indicate that the CE router sends a packet destined for the VM to an uplink interface of the gateway.
  • the sending module 1204 is further configured to issue routing information of the VM to the CE router.
  • processing module 1202 and the transmitting module 1204 refer to step 822 in the fifth embodiment.
  • the processing module 1202 is further configured to determine that all VMs belonging to the tenant to which the VM belongs on the computing node are revoked.
  • the sending module 1204 is further configured to instruct the computing node to revoke the gateway.
  • processing module 1202 and the transmitting module 1204 refer to step 824 in the fifth embodiment.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a computer.
  • the computer readable medium may include random access memory (English name: Random Access Memory, English abbreviation: RAM), read only memory (English full name: Read Only Memory, English abbreviation: ROM), electrically erasable Programmable Read Only Memory (English full name: Electrically Erasable Programmable Read Only Memory, English abbreviation: EEPROM), read-only optical disc (English full name: Compact Disc Read Only Memory, English abbreviation: CD-ROM) or other optical disc storage, disk storage media Or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of an instruction or data structure and that can be accessed by a computer.
  • Any connection may suitably be a computer readable medium.
  • the software uses coaxial cable, fiber optic cable, twisted pair, digital subscriber line (English full name: Digital Subscriber Line, English abbreviation: DSL) or wireless technologies such as infrared, radio and microwave from the website, server or Other remote source transmissions, such as coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, wireless, and microwave, are included in the fixing of the associated medium.
  • coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, wireless, and microwave
  • the disc and the disc include a compact disc (English full name: Compact Disc, English abbreviation: CD), a laser disc, a disc, a digital versatile disc (English full name: Digital Versatile Disc, English abbreviation: DVD), a floppy disk and Blu-ray discs, in which discs are usually magnetically replicated, while discs use lasers to optically replicate data. Combinations of the above should also be included within the scope of the computer readable media.

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明的实施例提供一种数据传输方法、虚拟网络管理装置及数据传输***，能够提供对直连网络方式南北向通信的分布式解决方案，提高数据转发效率，减少通信时延。具体方案为：获取虚拟网络的网络标识信息，虚拟网络的子网包括第一子网；获取路由器信息；获取虚拟机信息，虚拟机信息用于指示虚拟机所连接的子网；当确定虚拟机所连接的子网为第一子网，且第一子网与路由器连接，且路由器与外部网络连接时，指示计算节点创建网关，并对网关进行配置，网关用于对虚拟专用网络VPN报文进行转发。本发明用于进行直连网络方式南北向通信。

Description

一种数据传输方法、虚拟网络管理装置及数据传输*** 技术领域
本发明涉及通信领域，尤其涉及一种数据传输方法、虚拟网络管理装置及数据传输***。
背景技术
随着云计算技术的发展，数据中心近年来得到高速的发展，数据中心的规模越来越大，承载的业务越来越多，因而数据中心的通信数据量也越来越大。数据中心的通信包括东西向通信和南北向通信。其中东西向通信是指数据中心的内部通信，南北向通信是指数据中心和外部网络之间的通信。
图1为现有技术中数据中心内虚拟网络之间进行通信的示意图，其中，数据中心包括计算节点和网络节点，计算节点1包括虚拟机(英文全称：Virtual Machine，英文简称：VM)1和虚拟机2，计算节点2包括虚拟机3，其中虚拟机1和虚拟机3属于虚拟网络1，虚拟机2属于虚拟网络2。虚拟机通过计算节点内的虚拟机交换机(英文全称：Virtual Switch，英文简称：VS)进行数据交换。
结合图1，传统数据中心的通信方式中，通信数据通过路由器进行集中式转发，即虚拟网络1和虚拟网络2间的东西向通信流量需要经过网络节点1上的路由器进行转发，虚拟网络1和数据中心外部用户的通信流量也需要经过网络节点1上的路由器完成与用户边缘(英文全称：Customer Edge，英文简称：CE)路由器之间的转发。
集中式转发的处理方案中，随着通信数据量的增加，路由器的工作负荷不断增大，路由器的处理能力逐渐成为提高通信效率的瓶颈，制约着网络规模，因此对通信数据进行分布式转发的通信方案，成为云计算技术发展的新方向。
现有技术已经能够提供对东西向通信数据进行分布式转发的解决方案，然而对于南北向通信数据的分布式转发，目前还没有彻底的解决方案。
具体的，数据中心的南北向通信分为三种方式：
1)浮动网络互连协议(英文全称：Internet Protocol，英文简称：IP)地址方式南北向通信：数据中心的虚拟机作为客户机-服务器通信模式的服务器端，配置公网地址(浮动IP)，外部用户通过公网地址访问数据中心内的VM。
2)直连网络方式南北向通信：数据中心的VM作为客户端或者服务器，配置私网地址，通过虚拟专用网络(英文全称：Virtual Private Network，英文简称：VPN)和外部分支机构或远程用户通信。
3)源地址转换(英文全称：Source Network Address Translation，英文简称：SNAT)方式南北向通信：数据中心的多个VM通过SNAT共享一个公网IP地址，作为客户机访问外部网络上的服务器。
现有技术中的云计算平台，提供了对上述第一种南北向通信方式的分布式解决方案，然而其它两种方式的南北向通信数据还完全依赖现有的集中式处理方案实现转发。受网络节点上路由器处理能力的制约，当直连网络方式南北向通信流量较大，或者SNAT方式南北向通信流量较大时，易导致数据转发效率低下，通信时延大的问题。
发明内容
本发明的实施例提供一种数据传输方法、虚拟网络管理装置及数据传输***，能够提供对直连网络方式南北向通信的分布式解决方案，提高数据转发效率，减少通信时延。
为达到上述目的，本发明的实施例采用如下技术方案：
第一方面，一种数据传输方法，包括：
获取虚拟网络的网络标识信息，所述网络标识信息包括所述虚拟网络的子网信息，所述子网信息用于标识所述虚拟网络的子网，所述虚拟网络的子网包括第一子网；
获取路由器信息，所述路由器信息用于指示路由器与所述虚拟网络的子网之间的连接状态，以及所述路由器与外部网络之间的连接状态；
获取虚拟机信息，所述虚拟机信息用于指示虚拟机所连接的子网；
当确定所述虚拟机所连接的子网为所述第一子网，且所述第一子网与所述路由器连接，且所述路由器与所述外部网络连接时，将所述网络标识信息、 所述路由器信息以及所述虚拟机信息发送至所述虚拟机所在的计算节点，以指示所述计算节点创建网关，并对所述网关进行配置，所述网关用于对虚拟专用网络VPN报文进行转发。
结合第一方面，在第一种可能的实现方式中，所述对所述网关进行配置，包括：
根据所述网络标识信息为所述网关添加下行接口，所述下行接口的网络互连协议IP地址为所述第一子网的网关地址；
为所述网关添加上行接口，所述上行接口为所述外部网络的接口，用于与用户边缘CE路由器进行VPN报文转发；
根据所述网络标识信息为所述网关设置转发策略，所述转发策略包括：从所述虚拟机接收到的VPN报文，下一跳地址为所述CE路由器的下行接口的地址；从所述CE路由器的下行接口接收到的VPN报文，目的地址为所述虚拟机的地址。
结合第一方面的第一种可能的实现方式，在第二种可能的实现方式中，所述方法还包括：
创建路由信息发布模块，通过所述路由信息发布模块向所述CE路由器发布所述虚拟机的路由信息，以便于所述CE路由器维护更新CE路由表，所述CE路由表记录的内容包括从所述外部网络接收到的VPN报文，下一跳地址为所述网关上行接口的地址。
结合第一方面的第二种可能的实现方式，在第三种可能的实现方式中，所述创建路由信息发布模块，包括：
创建路由信息发布器实例，为所述路由信息发布器实例配置独立的地址空间，并将所述路由信息发布器实例与路由代理连接，所述路由信息发布器实例用于通过动态路由协议向所述CE路由器上对应的路由器实例发送所述虚拟机的路由信息。
结合第一方面的第二种可能的实现方式，在第四种可能的实现方式中，所述通过所述路由信息发布模块向所述CE路由器动态发布所述虚拟机的路由信息，包括：
在所述虚拟机创建、迁移或者撤销之后，通过所述路由信息发布模块向所述CE路由器发布更新的所述虚拟机的路由信息。
结合第一方面至第一方面的第四种可能的实现方式中的任一种，在第五种可能的实现方式中，所述方法还包括：
获取更新的路由器信息，根据所述更新的路由器信息，当所述第一子网与所述路由器之间的连接断开时，或者所述路由器与所述外部网络之间的连接断开时，撤销所述网关；
或者，从所述计算节点获取更新的虚拟机信息，根据所述更新的虚拟机信息，当所述虚拟机与所述第一子网之间的连接断开时，撤销所述网关。
第二方面，一种虚拟网络管理装置，包括：
虚拟网络管理模块，用于获取虚拟网络的网络标识信息，所述网络标识信息包括所述虚拟网络的子网信息，所述子网信息用于标识所述虚拟网络的子网，所述虚拟网络的子网包括第一子网；
网络节点管理模块，用于获取路由器信息，所述路由器信息用于指示路由器与所述虚拟网络的子网之间的连接状态，以及所述路由器与外部网络之间的连接状态；
计算节点管理模块，用于获取虚拟机信息，所述虚拟机信息用于指示虚拟机所连接的子网；
当所述计算节点管理模块确定所述虚拟机所连接的子网为所述第一子网，且所述第一子网与所述路由器连接，且所述路由器与所述外部网络连接时，将所述网络标识信息、所述路由器信息以及所述虚拟机信息发送至所述虚拟机所在的计算节点，以指示所述计算节点创建网关，并对所述网关进行配置，所述网关用于对虚拟专用网络VPN报文进行转发。
结合第二方面，在第一种可能的实现方式中，所述计算节点管理模块，具体用于，
根据所述网络标识信息为所述网关添加下行接口，所述下行接口的网络互连协议IP地址为所述第一子网的网关地址；
为所述网关添加上行接口，所述上行接口为所述外部网络的接口，用于与用户边缘CE路由器进行VPN报文转发；
根据所述网络标识信息为所述网关设置转发策略，所述转发策略包括：从所述虚拟机接收到的VPN报文，下一跳地址为所述CE路由器的下行接口的地址；从所述CE路由器的下行接口接收到的VPN报文，目的地址为所述虚拟 机的地址。
结合第二方面的第一种可能的实现方式，在第二种可能的实现方式中，所述网络节点管理模块，还用于创建路由信息发布模块，通过所述路由信息发布模块向所述CE路由器发布所述虚拟机的路由信息，以便于所述CE路由器维护更新CE路由表，所述CE路由表记录的内容包括从所述外部网络接收到的VPN报文，下一跳地址为所述网关上行接口的地址。
结合第二方面的第二种可能的实现方式，在第三种可能的实现方式中，所述网络节点管理模块，具体用于创建路由信息发布器实例，为所述路由信息发布器实例配置独立的地址空间，并将所述路由信息发布器实例与路由代理连接，所述路由信息发布器实例用于通过动态路由协议向所述CE路由器上对应的路由器实例发送所述虚拟机的路由信息。
结合第二方面的第二种可能的实现方式，在第四种可能的实现方式中，所述网络节点管理模块，具体用于在所述虚拟机创建、迁移或者撤销之后，通过所述路由信息发布模块向所述CE路由器发布更新的所述虚拟机的路由信息。
结合第二方面至第二方面的第四种可能的实现方式中的任一种，在第五种可能的实现方式中，所述网络节点管理模块，还用于获取更新的路由器信息；
所述计算节点管理模块，还用于根据所述更新的路由器信息，当所述第一子网与所述路由器之间的连接断开时，或者所述路由器与所述外部网络之间的连接断开时，撤销所述网关；
所述计算节点管理模块，还用于从所述计算节点获取更新的虚拟机信息；
所述计算节点管理模块，还用于根据所述更新的虚拟机信息，当所述虚拟机与所述第一子网之间的连接断开时，撤销所述网关。
第三方面一种数据传输***，包括：云资源管理器，虚拟网络管理装置，网络节点和计算节点；
所述云资源管理器，用于创建虚拟网络，并将所述虚拟网络的网络标识信息发送至所述虚拟网络管理装置，所述网络标识信息包括所述虚拟网络的子网信息，所述子网信息用于标识所述虚拟网络的子网，所述虚拟网络的子网包括第一子网；
所述云资源管理器，还用于指示所述网络节点创建路由器，并配置所述路由器与所述虚拟网络的子网之间的连接状态，以及所述路由器与外部网络之间的连接状态；
所述网络节点，用于将路由器信息发送至所述虚拟网络管理装置，所述路由器信息用于指示路由器与所述虚拟网络的子网之间的连接状态，以及所述路由器与外部网络之间的连接状态；
所述云资源管理器，还用于指示所述计算节点创建虚拟机，并将所述虚拟机与所述虚拟网络的子网连接；
所述计算节点，还用于将虚拟机信息发送至所述虚拟网络管理装置，所述虚拟机信息用于指示所述虚拟机所连接的子网；
当所述虚拟网络管理装置确定所述虚拟机所连接的子网为所述第一子网，且所述第一子网与所述路由器连接，且所述路由器与所述外部网络连接时，将所述网络标识信息、所述路由器信息以及所述虚拟机信息发送至所述虚拟机所在的计算节点，以指示所述计算节点创建网关，并对所述网关进行配置，所述网关用于对虚拟专用网络VPN报文进行转发。
结合第三方面，在第一种可能的实现方式中，所述虚拟网络管理装置，具体用于，
根据所述网络标识信息为所述网关添加下行接口，所述下行接口的网络互连协议IP地址为所述第一子网的网关地址；
为所述网关添加上行接口，所述上行接口为所述外部网络的接口，用于与用户边缘CE路由器进行VPN报文转发；
根据所述网络标识信息为所述网关设置转发策略，所述转发策略包括：从所述虚拟机接收到的VPN报文，下一跳地址为所述CE路由器的下行接口的地址；从所述CE路由器的下行接口接收到的VPN报文，目的地址为所述虚拟机的地址。
结合第三方面的第一种可能的实现方式，在第二种可能的实现方式中，所述虚拟网络管理装置，还用于指示所述网络节点创建路由信息发布模块，并将所述虚拟机的路由信息发送至所述路由信息发布模块；
所述路由信息发布模块，用于向所述CE路由器发布所述虚拟机的路由信息，以便于所述CE路由器维护更新CE路由表，所述CE路由表记录的内容包 括从所述外部网络接收到的VPN报文，下一跳地址为所述网关上行接口的地址。
结合第三方面的第二种可能的实现方式，在第三种可能的实现方式中，所述虚拟网络管理装置，具体用于指示所述网络节点创建路由信息发布器实例，为所述路由信息发布器实例配置独立的地址空间，并将所述路由信息发布器实例与路由代理连接，所述路由信息发布器实例用于通过动态路由协议向所述CE路由器上对应的路由器实例发送所述虚拟机的路由信息。
结合第三方面的第二种可能的实现方式，在第四种可能的实现方式中，所述虚拟网络管理装置，具体用于在所述虚拟机创建、迁移或者撤销之后，通过所述路由信息发布模块向所述CE路由器发布更新的所述虚拟机的路由信息。
结合第三方面至第三方面的第四种可能的实现方式中的任一种，在第五种可能的实现方式中，
所述虚拟网络管理装置，还用于获取更新的路由器信息，根据所述更新的路由器信息，当所述第一子网与所述路由器之间的连接断开时，或者所述路由器与所述外部网络的连接断开时，撤销所述网关；
所述虚拟网络管理装置，还用于获取更新的虚拟机信息，根据所述更新的虚拟机信息，当所述虚拟机与所述第一子网之间的连接断开时，撤销所述网关。
本发明的实施例所提供的数据传输方法、虚拟网络管理装置及数据传输***，通过获取虚拟网络的网络标识信息，获取路由器信息，获取虚拟机信息，并根据网络标识信息、路由器信息和虚拟机信息进行判断，当确定虚拟机所连接的子网为第一子网，且第一子网与路由器连接，且路由器与数据中心外部网络连接时，在计算节点上创建分布式网关，并对分布式网关进行配置，从而通过分布式网关对VPN报文进行转发。VPN报文无需依赖现有的集中式处理方案进行转发。进一步地，在同一计算节点上的属于同一虚拟网络或者不同虚拟网络的多个虚拟机，可以共用同一分布式网关。对于一个分布式网关，由于其只负责对所在计算节点上虚拟机的VPN报文进行转发，工作负荷小，分布式网关足以对这些虚拟机的VPN报文进行高效率的转发，避免了出现VPN报文拥堵的情况，减少了通信时延。
本申请的第四方面，提供了一种网关创建方法，包括：虚拟网络管理装置首先确定计算节点上建立的虚拟机VM所在的子网。
该虚拟网络管理装置具体可以通过该VM的IP地址查询存储的各个子网对应的IP地址段，以确认该VM所在的子网。
该虚拟网络管理装置确定该VM所在的子网对应的网关地址，该VM所在的子网的网络标识ID，该VM所属租户对应的外部网络的IP地址段，该外部网络的网络ID，以及该外部网络对应的网关地址。
该虚拟网络管理装置确定该外部网络的IP地址以及该外部网络的IP地址对应的MAC地址，该外部网络的IP地址属于该外部网络的IP地址段。
该租户在不同计算节点上创建的网关的上行接口的IP地址均属于该外部网络的IP地址段。因此在该虚拟网络装置获取了该外部网络的IP地址段后，需要从该外部网络的IP地址段中分配一个该外部网络的IP地址以及分配该外部网络的IP地址对应的MAC地址作为该网关的上行接口的地址。该分配动作可以由该虚拟网络装置执行，也可以由云资源管理器执行。
如果该分配动作由该虚拟网络装置执行，则该虚拟网络装置从该外部网络的IP地址段中分配一个未被占用的IP地址。如果该分配动作由云资源管理器执行，则该虚拟网络装置请求云资源管理器从该外部网络的IP地址段中分配一个未被占用的IP地址以及分配该外部网络的IP地址对应的MAC地址，该云资源管理器将分配的该外部网络的IP地址以及该外部网络的IP地址对应的MAC地址后发送至该虚拟网络装置。
该虚拟网络管理装置将该VM所在的子网对应的网关地址，该外部网络的IP地址与该外部网络的IP地址对应的MAC地址发送至该计算节点，并指示该计算节点创建网关。
由于此处针对在一个计算节点上建立一个VM的场景，因此仅涉及在该计算节点上建立对应的网关，实际的数据传输***中设置有多个计算节点，每个运行了VM的计算节点上均设置有对应的网关，这些网关分布式的部署于各个计算节点上，相对于传统的在网络节点上部署的集中式的路由器，采用分布式网关的场景下，VPN报文的处理效率不受限于网络节点的处理能力。
该网关配置有上行接口和下行接口，该网关的上行接口的地址包括该外部网络的IP地址与该外部网络的IP地址对应的MAC地址，该网关的上行接 口用于与CE路由器的下行接口通信，该CE路由器的下行接口的地址为该外部网络对应的网关地址，该网关的下行接口的地址为该VM所在的子网对应的网关地址，该网关的下行接口用于与该VM所在的子网通信。
该虚拟网络管理装置根据该外部网络对应的网关地址，该VM所在的子网的网络ID以及该外部网络的网络ID为该网关配置转发策略，该转发策略指示该网关将该VM发出的第一VPN报文转换为第二VPN报文，该第一VPN报文中携带该VM所在的子网的网络ID，该第二VPN报文中携带该外部网络的网络ID，该转发策略还指示该网关将该第二VPN报文通过该网关的上行接口发送至该CE路由器的下行接口。
结合第四方面，在第四方面的第一种实现方式中，该虚拟网络管理装置确定计算节点上建立的VM所在的子网之前，该方法还包括：该虚拟网络管理装置获取N个子网的子网信息，每个子网的子网信息包括网络标识ID和IP地址段，N为大于0的整数，该N个子网均属于该租户；该虚拟网络管理装置获取该每个子网对应的网关地址，该外部网络的IP地址段，该外部网络的网络ID，以及该外部网络对应的网关地址；该虚拟网络管理装置确定计算节点上建立的VM所在的子网包括：该虚拟网络管理装置获取该VM的IP地址，根据该VM的IP地址确定该VM所在的子网。
该虚拟管理装置根据该VM的IP地址确定的各类信息，由云资源管理器预先发送至该虚拟网络管理装置。
结合第四方面或第四方面的第一种实现方式，在第四方面的第二种实现方式中，该方法还包括：该虚拟网络管理装置向该CE路由器发布该VM的路由信息，该路由信息用于指示该CE路由器将目的地为该VM的报文发送至该网关的上行接口。
由于本方面提供的网关分布式的部署于各个计算节点之上，因此CE路由器接收到公网发来的报文时，该CE路由器需要根据该路由信息确认该报文是发往哪个网关的上行接口。
除了VM新建的场景中需要向该CE路由器发布VM的路由信息，当VM撤销或VM迁移时，也需要向该CE路由器更新被撤销的VM或者被迁移的VM对应的路由信息。
结合第四方面或第四方面的前述任一种实现方式，在第四方面的第三种 实现方式中，该方法还包括：该虚拟网络管理装置确定该计算节点上属于该租户的全部VM均撤销；该虚拟网络管理装置指示该计算节点撤销该网关。
在确定该计算节点上属于该租户的全部VM均撤销的情况下，也即确定了该网关所连接的VM全部撤销，此时撤销该网关有助于节省该计算节点的物理资源，并且也可以释放之前为该网关分配的外部网络的IP地址和MAC地址，由于每个租户所属的外部网络的地址资源有限，合理回收已分配的外部网络的地址资源有助于提升外部网络的地址资源的利用率。
本申请的第五方面，提供了一种虚拟网络管理装置，该虚拟网络管理装置用于为在新创建了VM的计算节点上创建网关。该装置包括了用于执行第四方面或第四方面的任意一种实现方式提供的网关创建方法的至少一个模块。
本申请的第六方面，提供了一种计算设备，该计算设备包括处理器、存储器。该计算设备可以为数据传输***中的虚拟网络管理装置，该计算设备上可以运行用于实现SDN控制器的软件，以使得该计算设备实现SDN控制器的功能。该计算设备运行时执行第四方面或第四方面的任意一种实现方式提供的网关创建方法。
本申请的第七方面，提供了一种数据传输***，该数据传输***包括了云资源管理器、第五方面或第六方面提供的虚拟网络管理装置、CE路由器以及至少一个计算节点。其中，云资源管理器与虚拟网络管理装置建立通信连接，虚拟网络管理装置与每个计算节点建立通信连接，CE路由器与每个计算节点建立通信连接。
该云资源管理器，用于将N个子网的子网信息，每个子网的子网信息包括网络ID和IP地址段，N为大于0的整数，该N个子网均属于一个租户，每个子网对应的网关地址，该租户对应的外部网络的IP地址段，该外部网络的网络ID，以及该外部网络对应的网关地址发送至该虚拟网络管理装置。
该虚拟网络管理装置，用于确定第一计算节点上创建的VM的IP地址，该VM属于该租户，根据该VM的IP地址确定该VM所在的子网，并确定该VM所在的子网对应的网关地址，该VM所在的子网的网络ID，该外部网络的IP地址以及该外部网络的IP地址对应的MAC地址，该外部网络的网络ID。
该虚拟网络管理装置，还用于将该VM所在的子网对应的网关地址，该外部网络的IP地址与该外部网络的IP地址对应的MAC地址发送至该计算节点， 并指示该第一计算节点创建网关。
该网关配置有上行接口和下行接口，该网关的上行接口的地址包括该外部网络的IP地址与该外部网络的IP地址对应的MAC地址，该网关的上行接口用于与该CE路由器的下行接口通信，该CE路由器的下行接口的地址为该外部网络对应的网关地址，该网关的下行接口的地址为该VM所在的子网对应的网关地址，该网关的下行接口用于与该VM所在的子网通信。
该虚拟网络管理装置，还用于根据该外部网络对应的网关地址，该VM所在的子网的网络标识ID以及该外部网络的网络ID生成转发策略，该转发策略指示该网关将该VM发出的第一VPN报文转换为第二VPN报文，该第一VPN报文中携带该VM所在的子网的网络标识ID，该第二VPN报文中携带该外部网络的网络ID，该转发策略还指示该网关将该第二VPN报文通过该网关的上行接口发送至该CE路由器的下行接口。
该第一计算节点，用于创建该网关以及接收该转发策略，并为该网关配置该转发策略。
结合第七方面，在第七方面的第一种实现方式中，该虚拟网络管理装置，还用于向该CE路由器发布该VM的路由信息，该路由信息用于指示该CE路由器将目的地为该VM的报文发送至该网关的上行接口。
结合第七方面，在第七方面的第二种实现方式中，该数据传输***还包括路由信息发布模块，该路由信息发布模块设置于该数据传输***的计算节点或网络节点；
该虚拟网络管理装置，还用于生成该VM的路由信息，该路由信息用于指示该CE路由器将目的地为该VM的报文发送至该网关的上行接口；
该路由信息发布模块，用于向该CE路由器发布该VM的路由信息。
结合第七方面或第七方面的任一种实现方式，在第七方面的第三种实现方式中，该虚拟网络管理装置，还用于确定该计算节点上属于该租户的全部VM均撤销，指示该计算节点撤销该网关。
本申请的第八方面，提供了一种存储介质，该存储介质中存储了程序代码，该程序代码被运行时，执行第四方面或第四方面的任意一种实现方式提供的方法。该存储介质包括但不限于快闪存储器(英文：flash memory)，硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid state drive， 缩写：SSD)。
本申请的第九方面，提供了一种计算机程序产品，该计算机程序产品可以为一个软件安装包，该软件安装包被运行时，执行第四方面或第四方面的任意一种实现方式提供的方法。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为现有技术中数据中心内虚拟网络之间通信方式的示意图；
图2为本发明的实施例一所提供的一种数据传输方法流程示意图；
图3为本发明的实施例二所提供的一种数据传输方法流程示意图；
图4为SDN控制器通过路由信息发布模块发布虚拟机的路由信息的示意图；
图5为本发明的实施例二中虚拟机与通信对端之间进行直连网络方式南北向通信的示意图；
图6为本发明的实施例三所提供的一种虚拟网络管理装置结构示意图；
图7为本发明的实施例四所提供的一种数据传输***的结构示意图；
图8为本发明的实施例五所提供的一种数据传输***的结构示意图；
图9为本发明的实施例提供的计算设备的组织结构示意图；
图10为本发明的实施例所提供的一种虚拟网络管理装置结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例一
本发明的实施例提供一种数据传输方法，应用于云计算场景中，提供对直连网络方式南北向通信的分布式解决方案。方法涉及云资源管理器、虚拟网络管理装置、网络节点、计算节点以及CE路由器。
其中，云资源管理器用于资源的分配和管理，包括虚拟网络创建，虚拟机创建、迁移和删除等。具体的，云资源管理器可以是Openstack，或者其它的云资源管理平台所提供的具有相同或者类似功能的对象。
网络节点，用于对网络数据进行传输、转发等，在本发明的实施例主要涉及对南北向通信数据的转发功能。
计算节点，本发明的实施例中在计算节点内创建虚拟机，虚拟机作为虚拟网络内的主机，是与通信对端进行南北向通信的主体。
虚拟网络管理装置，是对虚拟网络进行管理的主体。在本发明的实施例中，虚拟网络管理装置从网络节点和计算节点上报的信息中获取整个虚拟网络的拓扑结构，包括虚拟网络中虚拟机和路由器之间，以及路由器和数据中心外部网络之间的连接状态，从而根据虚拟网络的拓扑结构对虚拟网络进行管理。
用户边缘(英文全称：customer edge，缩写CE)路由器，连接数据中心和外部网络的路由器，虚拟网络的南北向通信的数据报文从数据中心发出后，通过CE路由器进入VPN，最终发往通信对端。通信对端发往数据中心内虚拟网络的南北向通信的数据报文，通过VPN发送至CE路由器，通过CE路由器转发至数据中心。
本发明的实施例所提供的数据传输方法，应用于虚拟网络管理装置，参照图2所示，包括以下步骤：
201、虚拟网络管理装置获取虚拟网络的网络标识信息。
网络标识信息包括虚拟网络的网络ID，以及虚拟网络的子网信息。其中，子网信息用于标识虚拟网络的子网。
用户通过云资源管理器创建虚拟网络，并在虚拟网络内创建子网。子网信息用于标识虚拟网络所包括的各个子网，其中包括第一子网。具体的，不同子网通过各自的网际互连协议(英文全称：Internet Protocol，英文简称：IP)地址以及对应的子网掩码进行标识。当然，虚拟网络也可以只包括一个子网，即第一子网。
可选的，虚拟网络管理装置为软件定义网络(英文全称：Software Defined Network，英文简称：SDN)控制器。本发明的实施例以虚拟网络管理装置为SDN控制器的应用场景为例进行说明。虚拟网络创建完成之后，网络节点将虚拟网络的网络标识信息发送至SDN控制器。
202、获取路由器信息。
其中，路由器信息用于指示路由器的连接状态，包括路由器和虚拟网络的哪些子网连接，以及路由器是否和数据中心的外部网络连接。例如，虚拟网络包括两个子网，如果两个子网均与路由器连接，则两个子网之间可以进行东西向通信。如果路由器进一步与外部网络连接，则两个子网中的任一子网可以进行南北向通信。
具体的，云资源管理器创建虚拟网络之后，指示网络节点创建路由器，以为创建的虚拟网络提供路由服务。路由器创建后，云资源管理器对其进行配置，即将路由器与虚拟网络内的部分或者全部子网连接，或者还可以进一步将路由器与数据中心的外部网络连接。云资源管理器对路由器进行配置之后，网络节点根据路由器的连接状态，将路由器信息发送至SDN控制器。
203、获取虚拟机信息，虚拟机信息用于指示虚拟机所连接的子网。
云资源管理器创建虚拟网络之后，指示计算节点创建虚拟机，并将虚拟机与虚拟网络的一个子网连接。本实施例中以虚拟机所连接的子网为第一子网的情况为例进行说明。虚拟机与第一子网连接之后，计算节点将虚拟机信息发送至SDN控制器。
204、当确定虚拟机所连接的子网为第一子网，且第一子网与路由器连接，且路由器与外部网络连接时，将网络标识信息、路由器信息以及虚拟机信息发送至虚拟机所在的计算节点，以指示计算节点创建分布式网关，并对分布式网关进行配置。
其中，分布式网关用于对虚拟专用网络VPN报文进行转发。具体的，VPN报文为虚拟机进行直连网络方式南北向通信时的数据报文。
特别地，在包括多个计算节点的应用场景中，针对不同计算节点，分别执行步骤201-204，在多个计算节点上建立分布式网关，对不同计算节点上的虚拟机VPN报文进行转发。
SDN控制器根据虚拟网络的网络标识信息、路由器信息和虚拟机信息进 行判断，如果第一子网与路由器连接，且路由器与外部网络连接，则表示虚拟机有进行直连网络方式南北向通信的需求，此时建立分布式网关。
分布式网关建立之后，对分布式网关进行配置，具体包括将第一子网与分布式网关连接，并将分布式网关与外部网络连接。这样虚拟机可以通过分布式网关向通信对端发送VPN报文，或者通过分布式网关接收通信对端发送的VPN报文。
本发明的实施例所提供的数据传输方法，SDN控制器通过从云资源管理器获取虚拟网络的网络标识信息，从网络节点获取路由器信息，从计算节点获取虚拟机信息，并根据网络标识信息、路由器信息和虚拟机信息进行判断，当确定虚拟机所连接的子网为第一子网，且第一子网与路由器连接，且路由器与外部网络连接时，在计算节点上创建分布式网关，并对分布式网关进行配置，从而通过分布式网关对VPN报文进行转发。VPN报文无需依赖现有的集中式处理方案进行转发。进一步地，在同一计算节点上的属于同一虚拟网络或者不同虚拟网络的多个虚拟机，可以共用同一分布式网关。对于一个分布式网关，由于其只负责对所在计算节点上虚拟机的VPN报文进行转发，工作负荷小，分布式网关足以对这些虚拟机的VPN报文进行高效率的转发，避免了出现VPN报文拥堵的情况，减少了通信时延。
实施例二
基于图2对应的实施例，本发明实施例二提供一种数据传输方法，参照图3所示，包括以下步骤：
301、云资源管理器创建虚拟网络，并将虚拟网络的网络标识信息发送至SDN控制器。
网络标识信息包括虚拟网络的网络ID，以及虚拟网络的子网信息。其中，子网信息用于标识虚拟网络的子网，虚拟网络的子网包括第一子网。
可选的，网络ID具体可以为虚拟局域网(英文全称：Virtual Local Area Network，英文简称：VLAN)ID或者虚拟可扩展局域网(英文全称：Virtual Extensible Local Area Network，英文简称：VxLAN)ID。虚拟网络的子网信息用于指示虚拟网络所包括的各个子网，具体可以包括各个子网的IP地址 以及子网掩码。
302、云资源管理器指示网络节点创建路由器，并配置路由器的连接状态。
其中，配置路由器的连接状态是指，将路由器与虚拟网络内的部分或者全部子网连接，或者还可以进一步将路由器与外部网络连接。
以第一子网为例，将路由器与第一子网连接是指，为路由器添加子网接口，该子网接口的IP地址就是第一子网的网关地址。其中第一子网为虚拟网络的任一子网。类似地，将路由器与外部网络连接是指，为路由器添加外部网络接口。
可选的，在一种具体的应用场景中，虚拟网络需要进行浮动IP方式南北向通信或者SNAT方式南北向通信时，还可以进一步为路由器创建命名空间(Name Space)。若虚拟网络只需要进行直连网络方式南北向通信，则无需为路由器创建命名空间。
303、网络节点将路由器信息发送至SDN控制器。
其中，路由器信息用于指示路由器的连接状态。具体用于指示路由器与虚拟网络中的哪些子网连接，以及是否与外部网络连接。
304、云资源管理器指示计算节点创建虚拟机，并将该虚拟机与虚拟网络的子网连接。
305、计算节点将虚拟机信息发送至SDN控制器。
其中，虚拟机信息用于指示虚拟机所连接的子网。
通过步骤301-305，SDN控制器获取虚拟网络的网络标识信息、路由器信息以及虚拟机信息，这些信息描述了虚拟网络的拓扑结构，包括虚拟网络内的子网与路由器之间的连接关系，子网所连接的虚拟机，以及虚拟网络与外部网络的连接状态。
306、当SDN控制器确定虚拟机所连接的子网为第一子网，且第一子网与路由器连接，且路由器与外部网络连接时，将网络标识信息、路由器信息以及虚拟机信息发送至虚拟机所在的计算节点，以指示计算节点创建分布式网关。
其中，分布式网关用于对虚拟专用网络VPN报文进行转发，VPN报文是指虚拟机进行直连网络方式南北向通信时的数据报文。
SDN控制器根据虚拟网络的拓扑结构进行判断，确定是否建立分布式网 关。具体的，如果路由器与外部网络没有连接，即没有为路由器配置外部网络接口，表示虚拟机没有进行直连网络方式南北向通信的需求，则无需建立分布式网关。如果路由器与外部网络连接，表示虚拟机有进行直连网络方式南北向通信的需求，则建立分布式网关。
307、SDN控制器对分布式网关进行配置。
对分布式网关进行配置，经过配置后分布式网关即可对VPN报文进行转发。对分布式网关的配置包括三点，为分布式网关添加下行接口，为分布式网关添加上行接口，以及为分布式网关设置转发策略。
分布式网关下行接口，是分布式网关与虚拟网络子网的接口，本实施例仅针对第一子网进行说明。SDN控制器根据网络标识信息确定第一子网在虚拟网络内所属的网段，然后为分布式网关添加下行接口，下行接口的IP地址为第一子网的网关地址。
分布式网关的上行接口，是分布式网关与CE路由器的接口。SDN控制器为分布式网关添加上行接口，上行接口为外部网络的接口，且与CE路由器下行接口属于同一外部网络，这样，分布式网关就可以与CE路由器进行VPN报文转发。
分布式网关的转发策略，即分布式网关对VPN报文进行转发的规则。可选的，转发策略具体可以是路由表的形式实现。或者通过OpenFlow流表的形式实现。基于OpenFlow的转发规则更加灵活，适用面更广，计算节点无需支持Name Space，也无需具备IP路由的能力，因此降低了对计算节点的要求。具体的，SDN控制器根据网络标识信息为分布式网关设置转发策略，转发策略包括：从虚拟机接收到的VPN报文，下一跳地址为CE路由器的下行接口的地址；从CE路由器的下行接口接收到的VPN报文，目的地址为虚拟机的地址。
308、SDN控制器指示网络节点创建路由信息发布模块，通过路由信息发布模块向CE路由器动态发布虚拟机的路由信息。
步骤307中，分布式网关接收到VPN报文后，根据分布式网关的转发策略，完成VPN报文从分布式网关向CE路由器的转发。
步骤308中，SDN控制器指示网络节点创建路由信息发布模块，并将虚拟机的路由信息动态发送至路由信息发布模块，由路由信息发布模块向CE路由器发布虚拟机的路由信息，以便于CE路由器维护更新CE路由表，CE路由 表记录的内容包括，从外部网络接收到的VPN报文，下一跳地址为分布式网关上行接口的地址。CE路由器接收到通信对端发送的VPN报文后，根据CE路由表完成VPN报文从CE路由器到分布式网关的转发。
路由信息发布模块包括路由代理(英文全称：Routing Agent)和路由信息发布器实例。指示网络节点创建路由信息发布模块，具体是指创建路由信息发布器实例，为路由信息发布器实例配置独立的地址空间，并将路由信息发布器实例与路由代理连接。
其中，路由代理用于和SDN控制器进行通信，获取虚拟机的路由信息。路由代理获取的虚拟机的路由信息，经路由信息发布器实例根据动态路由协议进行封装后向CE路由器发布。动态路由协议具体可以是边界网关协议(英文全称：Border Gateway Protocol，英文简称：BGP)。一个路由信息发布器实例可以向CE路由器发布虚拟网络内不同子网的多台虚拟机的路由信息。
向CE路由器动态发布虚拟机的路由信息，是指当虚拟机的路由信息有更新时，就向CE路由器发布更新的虚拟机的路由信息。例如在虚拟机创建、迁移或者撤销之后，SDN控制器通过路由信息发布模块向CE路由器发布更新的虚拟机的路由信息。
优选的，如图4所示，在一种具体的应用场景中，路由信息发布模块可以包括多个路由信息发布器实例，每个路由信息发布器实例配置独立的地址空间。同时，CE路由器通过VPN路由转发(英文全称：VPN Routing and Forwarding，英文简称：VRF)功能创建多个路由器实例，路由器实例与路由信息发布器实例一一对应。图4中，路由器实例1与路由信息发布器实例1对应，路由器实例2与路由信息发布器实例2对应。
路由信息发布器实例1将可以将N个虚拟网络内虚拟机的路由信息向路由器实例1发布，其中N为大于等于1的整数。这样，这N个虚拟网络共享路由器实例1，或者说路由器实例1为这N个虚拟网络提供路由服务。
同样地，路由信息发布器实例2也可以为至少一个虚拟网络提供路由服务。在云计算应用场景中，通常为一个租户配置一个路由器实例，该路由器实例为该租户的至少一个虚拟网络提供路由服务。不同路由器实例为不同租户的虚拟网络提供路由服务。
309、虚拟机通过分布式路由器和CE路由器与通信对端进行直连网络方式南北向通信。
结合图5，对虚拟机与通信对端进行直连网络方式南北向通信时，VPN报文的转发过程进行举例说明。
图5中，虚拟机的IP地址为192.168.100.6，媒体访问控制(英文全称：Media Access Control，英文简称：MAC)地址为1122-3344-6666。
分布式网关下行接口，即第一子网的网关为192.168.100.1，MAC地址为1122-3344-5555。
分布式网关的上行接口，即分布式网关与CE路由器的接口，IP地址为192.168.120.3，MAC地址为1122-3344-3333。
CE路由器下行接口，IP地址为192.168.120.1，MAC地址为1122-3344-1111。
通信对端的IP地址为192.168.200.35。通信对端与CE路由器之间通过穿过公网的VPN连接。
虚拟机向通信对端发送VPN报文过程：
虚拟机通过地址解析协议(英文全称：Address Resolution Protocol，英文简称：ARP)请求分布式网关下行接口MAC地址。获取到分布式网关下行接口MAC地址后，向分布式网关发送VPN报文，VPN报文的报头内容如表一所示，其中，虚拟网络的VLAN ID为500，外部网络的VLAN ID为100。
分布式网关接收到虚拟机发送的VPN数据报文后，根据目的IP查询转发策略(分布式网关的路由表或者OpenFlow流表)，确定下一跳地址为CE路由器的下行接口的地址，则将源MAC修改为分布式网关的上行接口MAC地址，目的MAC修改为CE路由器下行接口MAC地址。同时将虚拟网络的VLAN ID修改为外部网络的VLAN ID。然后将VPN报文通过分布式网关的上行接口发送至CE路由器下行接口。这样，分布式网关就将虚拟机发出的VPN报文从虚拟网络(VLAN ID 500)转发到了外部网络(VLAN ID 100)，并最终通过VPN穿过公网，被发送至通信对端。
通信对端向虚拟机发送VPN报文过程：
通信对端发送的VPN报文到达CE路由器后，根据CE路由表确定下一跳地址为分布式网关上行接口的地址，则将源MAC修改为CE路由器下行接口 MAC地址，目的MAC修改为分布式网关的上行接口MAC地址，然后将VPN报文通过CE路由器下行接口发送至分布式网关上行接口。
分布式网关接收到CE路由器发送的VPN数据报文后，根据目的IP确定虚拟机所连接的虚拟网络子网，将源MAC修改为分布式网关下行接口MAC地址，目的MAC修改为虚拟机MAC地址，同时将外部网络的VLAN ID修改为虚拟网络的VLAN ID，然后将VPN报文通过分布式网关下行接口发送至虚拟机。
Figure PCTCN2016096372-appb-000001
表一
310、SDN控制器从网络节点获取更新的路由器信息。
当路由器的连接状态发生变化时，例如，第一子网与路由器断开连接，或者路由器与外部网络断开连接，则网络节点向SDN控制器上报更新的路由器信息。
311、根据更新的路由器信息，当第一子网与路由器之间的连接断开时，或者路由器与外部网络之间的连接断开时，SDN控制器撤销分布式网关。
312、SDN控制器从计算节点获取更新的虚拟机信息。
当虚拟机的连接状态发生变化时，例如虚拟机与第一子网的连接断开，包括创建新的虚拟机，或已有的虚拟机撤销、迁移的情况。此时，计算节点向SDN控制器上报更新的虚拟机信息。
313、根据更新的虚拟机信息，当虚拟机与第一子网的连接断开时，撤销分布式网关。
虚拟机与第一子网的连接断开，包括虚拟机撤销、迁移的情况。当然，在第一子网有多个虚拟机位于计算节点内的应用场景中，当计算节点内第一子网的全部虚拟机均与第一子网断开时，SDN控制器撤销分布式网关。
结合步骤306，如果虚拟机没有进行直连网络方式南北向通信的需求，则可以撤销分布式网关。只在需要进行直连网络方式南北向通信的计算节点上创建分布式网关，以尽可能地减小外部网络的规模，节约计算节点的软硬件资源。
本发明的实施例所提供的数据传输方法，SDN控制器通过从云资源管理器获取虚拟网络的网络标识信息，从网络节点获取路由器信息，从计算节点获取虚拟机信息，并根据网络标识信息、路由器信息和虚拟机信息进行判断，当确定虚拟机所连接的子网为第一子网，第一子网与路由器连接，且路由器与外部网络连接时，在计算节点上创建分布式网关，并对分布式网关进行配置，从而通过分布式网关对VPN报文进行转发。VPN报文无需依赖现有的集中式处理方案进行转发。进一步地，在同一计算节点上的属于同一虚拟网络或者不同虚拟网络的多个虚拟机，可以共用同一分布式网关。对于一个分布式网关，由于其只负责对所在计算节点上虚拟机的VPN报文进行转发，工作负荷小，分布式网关足以对这些虚拟机的VPN报文进行高效率的转发，避免了出现VPN报文拥堵的情况，减少了通信时延。
实施例三
基于实施例一及实施例二所提供的数据传输方法，本发明的实施例三提供一种虚拟网络管理装置，用于执行上述实施例中SDN控制器所完成的功能。结合图6所示，虚拟网络管理装置600包括：
虚拟网络管理模块601，用于获取虚拟网络的网络标识信息，网络标识信息包括虚拟网络的子网信息，子网信息用于标识虚拟网络的子网，虚拟网络的子网包括第一子网。
网络节点管理模块602，用于获取路由器信息，路由器信息用于指示路由器与虚拟网络的子网之间的连接状态，以及路由器与外部网络之间的连接状态。
计算节点管理模块603，用于获取虚拟机信息，虚拟机信息用于指示虚 拟机所连接的子网。
当计算节点管理模块603确定虚拟机所连接的子网为第一子网，且第一子网与路由器连接，且路由器与外部网络连接时，将网络标识信息、路由器信息以及虚拟机信息发送至虚拟机所在的计算节点，以指示计算节点创建网关，并对网关进行配置，网关用于对虚拟专用网络VPN报文进行转发。
可选的，计算节点管理模块603，具体用于，
根据网络标识信息为网关添加下行接口，下行接口的网络互连协议IP地址为第一子网的网关地址。
为网关添加上行接口，上行接口为外部网络的接口，用于与用户边缘CE路由器进行VPN报文转发。
根据网络标识信息为网关设置转发策略，转发策略包括：从虚拟机接收到的VPN报文，下一跳地址为CE路由器的下行接口的地址；从CE路由器的下行接口接收到的VPN报文，目的地址为虚拟机的地址。
可选的，网络节点管理模块602，还用于创建路由信息发布模块，通过路由信息发布模块向CE路由器发布虚拟机的路由信息，以便于CE路由器维护更新CE路由表，CE路由表记录的内容包括从外部网络接收到的VPN报文，下一跳地址为网关上行接口的地址。
可选的，网络节点管理模块602，具体用于创建路由信息发布器实例，为路由信息发布器实例配置独立的地址空间，并将路由信息发布器实例与路由代理连接，路由信息发布器实例用于通过动态路由协议向CE路由器上对应的路由器实例发送虚拟机的路由信息。
可选的，网络节点管理模块602，具体用于在虚拟机创建、迁移或者撤销之后，通过路由信息发布模块向CE路由器发布更新的虚拟机的路由信息。
可选的，网络节点管理模块602，还用于获取更新的路由器信息。
计算节点管理模块603，还用于根据更新的路由器信息，当第一子网与路由器之间的连接断开时，或者路由器与外部网络之间的连接断开时，撤销网关。
计算节点管理模块603，还用于从计算节点获取更新的虚拟机信息。
计算节点管理模块603，还用于根据更新的虚拟机信息，当虚拟机与第一子网之间的连接断开时，撤销网关。
本发明的实施例所提供的虚拟网络管理装置，通过从云资源管理器获取虚拟网络的网络标识信息，从网络节点获取路由器信息，从计算节点获取虚拟机信息，并根据网络标识信息、路由器信息和虚拟机信息进行判断，当确定虚拟机所连接的子网为第一子网，第一子网与路由器连接，且路由器与数据中心外部网络连接时，在计算节点上创建分布式网关，并对分布式网关进行配置，从而通过分布式网关对VPN报文进行转发。VPN报文无需依赖现有的集中式处理方案进行转发。进一步地，在同一计算节点上的属于同一虚拟网络或者不同虚拟网络的多个虚拟机，可以共用同一分布式网关。对于一个分布式网关，由于其只负责对所在计算节点上虚拟机的VPN报文进行转发，工作负荷小，分布式网关足以对这些虚拟机的VPN报文进行高效率的转发，避免了出现VPN报文拥堵的情况，减少了通信时延。
实施例四
本发明的实施例四提供一种数据传输***，参照图7所示，数据传输***70包括：云资源管理器701，虚拟网络管理装置702，网络节点703和计算节点704，用于完成实施例二中各执行主体对应的功能，实现实施例二所提供的数据传输方法。
其中，云资源管理器701，用于创建虚拟网络，并将虚拟网络的网络标识信息发送至虚拟网络管理装置702，网络标识信息包括虚拟网络的子网信息，子网信息用于标识虚拟网络的子网，虚拟网络的子网包括第一子网。
云资源管理器701，还用于指示网络节点703创建路由器，并配置路由器与虚拟网络的子网之间的连接状态，以及路由器与外部网络之间的连接状态。
网络节点703，用于将路由器信息发送至虚拟网络管理装置702，路由器信息用于指示路由器与虚拟网络的子网之间的连接状态，以及路由器与外部网络之间的连接状态。
云资源管理器701，还用于指示计算节点704创建虚拟机，并将虚拟机与虚拟网络的子网连接。
计算节点704，还用于将虚拟机信息发送至虚拟网络管理装置702，虚拟机信息用于指示虚拟机所连接的子网。
当虚拟网络管理装置702确定虚拟机所连接的子网为第一子网，且第一子网与路由器连接，且路由器与外部网络连接时，将网络标识信息、路由器信息以及虚拟机信息发送至虚拟机所在的计算节点704，以指示计算节点704创建网关，并对网关进行配置，网关用于对虚拟专用网络VPN报文进行转发。
可选的，虚拟网络管理装置702，具体用于，
根据网络标识信息为网关添加下行接口，下行接口的网络互连协议IP地址为第一子网的网关地址。
为网关添加上行接口，上行接口为外部网络的接口，用于与用户边缘CE路由器进行VPN报文转发。
根据网络标识信息为网关设置转发策略，转发策略包括：从虚拟机接收到的VPN报文，下一跳地址为CE路由器的下行接口的地址；从CE路由器的下行接口接收到的VPN报文，目的地址为虚拟机的地址。
可选的，虚拟网络管理装置702，还用于指示网络节点703创建路由信息发布模块，并将虚拟机的路由信息发送至路由信息发布模块。
路由信息发布模块，用于向CE路由器发布虚拟机的路由信息，以便于CE路由器维护更新CE路由表，CE路由表记录的内容包括从外部网络接收到的VPN报文，下一跳地址为网关上行接口的地址。
可选的，虚拟网络管理装置702，具体用于指示网络节点703创建路由信息发布器实例，为路由信息发布器实例配置独立的地址空间，并将路由信息发布器实例与路由代理连接，路由信息发布器实例用于通过动态路由协议向CE路由器上对应的路由器实例发送虚拟机的路由信息。
可选的，虚拟网络管理装置702，具体用于在虚拟机创建、迁移或者撤销之后，通过路由信息发布模块向CE路由器发布更新的虚拟机的路由信息。
可选的，虚拟网络管理装置702，还用于获取更新的路由器信息，根据更新的路由器信息，当第一子网与路由器之间的连接断开时，或者路由器与外部网络的连接断开时，撤销网关。
虚拟网络管理装置702，还用于获取更新的虚拟机信息，根据更新的虚拟机信息，当虚拟机与第一子网之间的连接断开时，撤销网关。
本发明的实施例所提供的数据传输***，虚拟网络管理装置通过从云资源管理器获取虚拟网络的网络标识信息，从网络节点获取路由器信息，从计 算节点获取虚拟机信息，并根据网络标识信息、路由器信息和虚拟机信息进行判断，当确定虚拟机所连接的子网为第一子网，第一子网与路由器连接，且路由器与数据中心外部网络连接时，在计算节点上创建分布式网关，并对分布式网关进行配置，从而通过分布式网关对VPN报文进行转发。VPN报文无需依赖现有的集中式处理方案进行转发。进一步地，在同一计算节点上的属于同一虚拟网络或者不同虚拟网络的多个虚拟机，可以共用同一分布式网关。对于一个分布式网关，由于其只负责对所在计算节点上虚拟机的VPN报文进行转发，工作负荷小，分布式网关足以对这些虚拟机的VPN报文进行高效率的转发，避免了出现VPN报文拥堵的情况，减少了通信时延。
实施例五
本发明实施例五提供一种网关创建方法，该方法运用于图8所示的数据传输***，该方法包括：
步骤802，云资源管理器发送N个子网的子网信息至SDN控制器，N为大于0的整数。
租户通过云资源管理器创建N个子网，这N个子网可以为VLAN子网或VxLAN子网或其他类型的子网。每个子网的子网信息包括：该子网对应的网络ID以及该子网的IP地址段。例如第一子网的子网信息包括：VLAN ID 500，192.168.100.0/24。
步骤804，该云资源管理器将每个子网对应的网关地址发送至该SDN控制器。网关地址具体包括：网关的IP地址与MAC地址。例如，该第一子网的网关地址包括，IP地址192.168.100.1，MAC地址1122-3344-5555。
步骤806，该云资源管理器将该N个子网对应的外部网络的IP地址段，该外部网络的网络ID，以及该外部网络对应的网关地址发送至该SDN控制器。
例如，该外部网络的IP地址段包括：192.168.120.0/24，该外部网络的网络ID为VLAN ID 100，该外部网络对应的网关地址包括：IP地址192.168.10120.1,MAC地址1122-3344-1111。
该外部网络实际可以为VPN为本数据传输***分配的多个外部网络中的一个。本数据传输***的每个租户均被分配了一个IP地址段，作为该租户的外部网络。该外部网络用于在该租户所属的分布式网关和CE路由器之间路由 报文。
步骤804和步骤806的执行顺序可以互换，或者步骤802、步骤804、步骤806可以合并为同一步骤，或者步骤804和步骤806可以合并为同一步骤。
可选的，该数据中心中实际可能存在多个租户，因此云资源管理器向SDN控制器发送各类信息时还需要发送租户标识。同一租户所属的子网对应的外部网络的IP地址段以及该外部网络对应的网关地址相同。一个租户的外部网络对应的网关地址实际为该租户在CE路由器上对应的下行接口的地址。
步骤806后，该SDN控制器内存储有各个租户对应的子网的子网信息，每个子网对应的网关地址，外部网络的IP地址段，外部网络的网络ID以及该外部网络对应的网关地址。
例如：
租户1子网信息11子网的网关地址11外部网络的IP地址段1外部网络的网络ID1外部网络的网关地址1
其中，子网信息11包括VLAN ID 500，192.168.10 0.0/24；子网的网关地址11为IP地址192.168.100.1，MAC地址1122-3344-5555；外部网络的IP地址段1为192.168.120.0/24；外部网络的网络ID为VLAN ID 100；外部网络的网关地址1为IP地址192.168.10 120.1,MAC地址1122-3344-1111。
租户1子网信息12子网的网关地址12外部网络的IP地址段1外部网络的网络ID1外部网络的网关地址1
…
租户1子网信息1N子网的网关地址1N外部网络的IP地址段1外部网络的网络ID1外部网络的网关地址1
租户2子网信息21子网的网关地址21外部网络的IP地址段2外部网络的网络ID2外部网络的网关地址2
…
租户3子网信息31子网的网关地址31外部网络的IP地址段3外部网络的网络ID3外部网络的网关地址3
….
步骤808，该云资源管理器指示一个计算节点创建VM。
示例性的，以步骤808中在计算节点1上创建VM-1为例，该VM-1的IP地址为192.168.100.6，MAC地址为1122-3344-6666。该VM-1属于租户1。
步骤808中，该云资源管理器除了将待创建的VM的IP地址和MAC地址发送至计算节点之外，还将该VM所在子网对应的子网信息也发送至计算节点。
步骤810，该计算节点向该SDN控制器发送VM创建消息。该VM创建消息指示该SDN控制器该计算节点上创建完成该VM。
计算节点1创建成功VM-1后，通知该SDN控制器VM-1创建完成，SDN控制器获取VM-1的IP地址。
该VM-1的IP地址具体可以携带于计算节点1发送给该SDN控制器的该VM创建消息中。
步骤812，该SDN控制器确定该VM所在子网对应的信息，包括子网的网关地址，外部网络的IP地址段，外部网络的网络ID，外部网络的网关地址。
步骤814，该SDN控制器确定该外部网络的IP地址以及该IP地址对应的MAC地址。
该SDN控制器从该外部网络的IP地址段中分配IP地址，并且分配一个对应于该IP地址的MAC地址。
或者，该SDN控制器请求该云资源管理器从该外部网络的IP地址段中分配IP地址，并且分配一个对应于该IP地址的MAC地址。
以步骤808中创建VM-1为例，步骤810中，该SDN控制器获知VM-1的IP地址为192.168.100.6。步骤812中，该SDN控制器根据VM-1的IP地址确定VM-1所在的子网对应的信息包括：子网信息VLAN ID 500，192.168.10 0.0/24；子网的网关地址IP地址192.168.100.1，MAC地址1122-3344-5555；外部网络的IP地址段192.168.120.0/24；外部网络的网络ID VLAN ID100；外部网络的网关的IP地址192.168.10 120.1,MAC地址1122-3344-1111。
该SDN控制器从192.168.120.0/24中分配IP地址，作为后续计算节点1上创建的分布式网关的上行接口的IP地址，例如为192.168.120.3。该SDN控制器还分配与该IP地址对应的MAC地址，例如为1122-3344-3333，作为计算节点1上创建的分布式网络的上行接口的MAC地址。
或者，云资源管理器统一管理整个数据传输***中IP地址和MAC地址，则步骤814中，该SDN控制器请求该云资源管理器从192.168.120.0/24中 分配IP地址，并分配该IP地址对应的MAC地址。
步骤816，该计算节点接收该VM所在子网对应的子网的网关地址，该外部网络的IP地址以及该IP地址对应的MAC地址。
步骤816中接收的信息用于在该计算节点上创建分布式网关。其中，该子网的网关地址用于创建该分布式网关对应于该VM所在子网的下行接口，该外部网络的IP地址和MAC地址用于创建该分布式网关的上行接口。
步骤818，该计算节点根据该VM所在子网对应的子网的网关地址，外部网络的IP地址和MAC地址，建立分布式网关。
步骤820，该SDN控制器生成该分布式网关的转发策略，并将该转发策略发送至该计算节点，以供该计算节点通过该转发策略配置该分布式网关。
该SDN控制器根据该外部网络对应的网关地址，该VM所在的子网的网络ID以及该外部网络的网络ID为该分布式网关配置转发策略。
由于该分布式网关将该VM所在的子网发出的报文发送至该外部网络的过程中，该报文跨越了子网，也即该报文携带的网络ID由该VM所在的子网的网络ID转换为该外部网络的网络ID。
该VM所在的子网的网络标识ID以及该外部网络的网络ID用于设置该转发策略。该转发策略包括将该VM发出的第一VPN报文转换为第二VPN报文，该第一VPN报文中携带该VM所在的子网的网络标识ID，该第二VPN报文中携带该外部网络的网络ID。
该转发策略除了用于修改报文携带的网络ID之外，还需要指示报文的路由路径。
该外部网络的MAC地址和该外部网络的网关地址用于在该分布式网关中设置该转发策略，该转发策略指示将该VM发出的报文通过该分布式网关的上行接口发送至该外部网络的网关地址，也即将VM-1发出的报文，通过该分布式网关的上行接口发送至该CE路由器上对应于租户1的下行接口。
该转发策略具体可以通过流表或路由表的形式实现。通过流表实现的情况下，该流表需要将VM发出的报文的源MAC地址修改为该分布式网络上行接口的MAC地址，将该报文的目的MAC地址修改为该CE路由器上对应于该VM所属的租户对应的下行接口的MAC地址，还将该报文携带的该VM所属子网的网络ID修改为该VM所属的租户对应的外部网络的网络ID。
在步骤814后，该SDN控制器获知该VM的IP地址，同时该SDN控制器也获知该分布式网关的上行接口的IP地址和MAC地址，因此该SDN控制器需要向CE路由器发布该VM的路由信息，以指示该CE路由器将到发往该VM的报文发送至该分布式网关的上行接口。
步骤822，该SDN控制器通过路由信息发布模块向CE路由器发布路由信息，该路由信息指示该CE路由器将到目的地为该VM的报文发送至该分布式网关的上行接口。
该路由信息发布模块可以部署于SDN控制器内部，或部署于任一计算节点。该路由信息具体可以指示发往该VM的报文的下一跳为该分布式网关的上行接口的IP地址。
该路由信息发布模块的具体实现方式，参考前述实施例中与图4对应的部分。
步骤822在步骤814之后任意时刻执行，分布式网关的建立过程与向CE路由器的路由发布过程也可以同步进行。
除了前述新建VM的场景，在已经建立的VM发生迁移情况下，该SDN控制器也可以通过该路由信息发布模块向CE路由器发布迁移后的VM的路由信息，或者在已经建立的VM撤销的情况下，该SDN控制器通知CE路由器将该撤销的VM的路由信息删除。
步骤824，该SDN控制器确定该计算节点上属于该VM所属的租户的全部VM均撤销，则指示该计算节点撤销该分布式网关。
前述步骤808至步骤818中介绍了一个租户在一个计算节点上建立的第一个VM后，该SDN控制器为该租户在该计算节点上建立分布式网关的过程。实际中，若该数据传输***中还包括其他租户，并且其他租户也在该计算节点上建立了VM，则该SDN控制器还需要为每个在该计算节点上建立的VM的租户建立一个分布式网关。
该SDN控制器管理了该数据传输***中，每个租户所属的每个VM建立于哪个计算节点。因此，当该SDN控制器确认某一租户在某一计算节点上的全部VM均撤销，则该SDN控制器指示该计算节点将之前建立的分布式网关撤销。
步骤824的执行与前述步骤没有时序关系，也即该SDN控制器在为新建的VM建立分布式网关的同时，也可以监控每个租户在每个计算节点上所属 VM的运行情况，一旦发现有某一租户在某一计算节点上的全部VM均撤销，则该SDN控制器指示该计算节点将之前建立的分布式网关撤销。
步骤824的执行，使得如果某一计算节点上属于某一租户的全部VM都被撤销，则可以删除该计算节点上属于该租户的分布式网关，释放该计算节点的资源，提升了计算节点的资源的使用效率。同时也可以释放出该分布式网关占用的该租户对应的外部网络的IP和MAC地址，提升外部网络的地址的使用效率。
本发明的实施例所提供的方法，在计算节点上创建分布式网关，并对分布式网关进行配置，从而通过分布式网关对VPN报文进行转发。VPN报文无需依赖现有的集中式处理方案进行转发，提升了VPN报文的处理效率。
以上提供的数据传输***中，VM发出的VPN报文的处理过程和VM接收到VPN报文的处理过程参考前述图5对应的实施例。
前述附图中的虚拟网络管理装置或SDN控制器可以通过计算设备1000实现。计算设备1000的组织结构示意图如图9所示，包括处理器1002、存储器1004，还可以包括总线1008、通信接口1006。
其中，处理器1002、存储器1004和通信接口1006可以通过总线1008实现彼此之间的通信连接，也可以通过无线传输等其他手段实现通信。
处理器1002可以为中央处理器(英文：central processing unit，缩写：CPU)。
存储器1004可以包括易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)；存储器也可以包括非易失性存储器(英文：non-volatile memory)，例如只读存储器(英文：read-only memory，缩写：ROM)，快闪存储器，HDD或SSD；存储器204还可以包括上述种类的存储器的组合。用于实现本申请图8提供的方法中SDN控制器执行的部分的程序代码保存在存储器1004中，并由处理器1002来执行。计算设备1000通过通信接口1006与数据传输网络中其他节点以及云资源管理通信。
基于实施例五所提供的数据传输方法，本发明的实施例提供一种虚拟网络管理装置，用于执行上述实施例中SDN控制器所完成的功能。如图10所示， 虚拟网络管理装置1200包括：处理模块1202，发送模块1204，以及接收模块1206。
虚拟网络管理装置1200可以通过专用集成电路(英文：application-specific integrated circuit，缩写：ASIC)实现，或可编程逻辑器件(英文：programmable logic device，缩写：PLD)实现。上述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic device，缩写：CPLD)，现场可编程门阵列(英文：field programmable gate array,缩写：FPGA)，通用阵列逻辑(英文：generic array logic,缩写：GAL)或其任意组合。
接收模块1206，用于接收云资源管理器发送的N个子网的子网信息，每个子网对应的网关地址，该N个子网对应的外部网络的IP地址段，该外部网络的网络ID，以及该外部网络对应的网关地址。
接收模块1206将接收的N个子网的子网信息，每个子网对应的网关地址，该N个子网对应的外部网络的IP地址段，该外部网络的网络ID，以及该外部网络对应的网关地址发送至处理模块1202。
接收模块1206，还用于接收VM创建消息。
处理模块1202，用于确定该VM所在子网对应的信息，包括子网的网关地址，外部网络的IP地址段，外部网络的网络ID，外部网络的网关地址，并确定该外部网络的IP地址以及该IP地址对应的MAC地址。
发送模块1204，还用于将该VM所在子网对应的子网的网关地址，该外部网络的IP地址以及该IP地址对应的MAC地址发送至创建该VM的计算节点。
处理模块1202，还用于该SDN控制器根据该外部网络对应的网关地址，该VM所在的子网的网络标识ID以及该外部网络的网络ID生成转发策略。
发送模块1204，还用于将该转发策略发送至该计算节点。
可选的，处理模块1202，还用于生成该VM的路由信息，该路由信息用于指示该CE路由器将目的地为该VM的报文发送至该网关的上行接口。发送模块1204，还用于向该CE路由器发布该VM的路由信息。
处理模块1202和发送模块1204的以上功能参考实施例五中的步骤822。
可选的，处理模块1202，还用于确定该计算节点上属于该VM所属的租户的全部VM均撤销。发送模块1204，还用于指示该计算节点撤销该网关。
处理模块1202和发送模块1204的以上功能参考实施例五中的步骤824。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发明可以用硬件实现，或固件实现，或它们的组合方式来实现。当使用软件实现时，可以将上述功能存储在计算机可读介质中或作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是计算机能够存取的任何可用介质。以此为例但不限于：计算机可读介质可以包括随机存储器(英文全称：Random Access Memory，英文简称：RAM)、只读存储器(英文全称：Read Only Memory，英文简称：ROM)、电可擦可编程只读存储器(英文全称：Electrically Erasable Programmable Read Only Memory，英文简称：EEPROM)、只读光盘(英文全称：Compact Disc Read Only Memory，英文简称：CD-ROM)或其他光盘存储、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质。此外。任何连接可以适当的成为计算机可读介质。例如，如果软件是使用同轴电缆、光纤光缆、双绞线、数字用户专线(英文全称：Digital Subscriber Line，英文简称：DSL)或者诸如红外线、无线电和微波之类的无线技术从网站、服务器或者其他远程源传输的，那么同轴电缆、光纤光缆、双绞线、DSL或者诸如红外线、无线和微波之类的无线技术包括在所属介质的定影中。如本发明所使用的，盘和碟包括压缩光碟(英文全称：Compact Disc，英文简称：CD)、激光碟、光碟、数字通用光碟(英文全称：Digital Versatile Disc，英文简称：DVD)、软盘和蓝光光碟，其中盘通常磁性的复制数据，而碟则用激光来光学的复制数据。上面的组合也应当包括在计算机可读介质的保护范围之内。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。

Claims (9)

  1. 一种网关创建方法，其特征在于，包括：
    虚拟网络管理装置确定计算节点上建立的虚拟机VM所在的子网；
    所述虚拟网络管理装置确定所述VM所在的子网对应的网关地址，所述VM所在的子网的网络标识ID，所述VM所属租户对应的外部网络的IP地址段，所述外部网络的网络ID，以及所述外部网络对应的网关地址；
    所述虚拟网络管理装置确定所述外部网络的IP地址以及所述外部网络的IP地址对应的媒体访问控制MAC地址，所述外部网络的IP地址属于所述外部网络的IP地址段；
    所述虚拟网络管理装置将所述VM所在的子网对应的网关地址，所述外部网络的IP地址与所述外部网络的IP地址对应的MAC地址发送至所述计算节点，并指示所述计算节点创建网关；
    所述网关配置有上行接口和下行接口，所述网关的上行接口的地址包括所述外部网络的IP地址与所述外部网络的IP地址对应的MAC地址，所述网关的上行接口用于与用户边缘CE路由器的下行接口通信，所述CE路由器的下行接口的地址为所述外部网络对应的网关地址，所述网关的下行接口的地址为所述VM所在的子网对应的网关地址，所述网关的下行接口用于与所述VM所在的子网通信；
    所述虚拟网络管理装置根据所述外部网络对应的网关地址，所述VM所在的子网的网络ID以及所述外部网络的网络ID为所述网关配置转发策略，所述转发策略指示所述网关将所述VM发出的第一VPN报文转换为第二VPN报文，所述第一VPN报文中携带所述VM所在的子网的网络ID，所述第二VPN报文中携带所述外部网络的网络ID，所述转发策略还指示所述网关将所述第二VPN报文通过所述网关的上行接口发送至所述CE路由器的下行接口。
  2. 如权利要求1所述的方法，其特征在于，所述虚拟网络管理装置确定计算节点上建立的VM所在的子网之前，所述方法还包括：
    所述虚拟网络管理装置获取N个子网的子网信息，每个子网的子网信息包括网络ID和IP地址段，N为大于0的整数，所述N个子网均属于所述租户；
    所述虚拟网络管理装置获取所述每个子网对应的网关地址，所述外部网络的IP地址段，所述外部网络的网络ID，以及所述外部网络对应的网关地 址；
    所述虚拟网络管理装置确定计算节点上建立的VM所在的子网包括：
    所述虚拟网络管理装置获取所述VM的IP地址，根据所述VM的IP地址确定所述VM所在的子网。
  3. 如权利要求1或2所述的方法，其特征在于，还包括：
    所述虚拟网络管理装置向所述CE路由器发布所述VM的路由信息，所述路由信息用于指示所述CE路由器将目的地为所述VM的报文发送至所述网关的上行接口。
  4. 如权利要求1至3任一所述的方法，其特征在于，还包括：
    所述虚拟网络管理装置确定所述计算节点上属于所述租户的全部VM均撤销；
    所述虚拟网络管理装置指示所述计算节点撤销所述网关。
  5. 一种虚拟网络管理装置，其特征在于，包括：
    处理模块，用于确定计算节点上建立的虚拟机VM所在的子网，并确定所述VM所在的子网对应的网关地址，所述VM所在的子网的网络标识ID，所述VM所属租户对应的外部网络的IP地址段，所述外部网络的网络ID，以及所述外部网络对应的网关地址，以及确定所述外部网络的IP地址以及所述外部网络的IP地址对应的媒体访问控制MAC地址，所述外部网络的IP地址属于所述外部网络的IP地址段；
    发送模块，用于将所述VM所在的子网对应的网关地址，所述外部网络的IP地址与所述外部网络的IP地址对应的MAC地址发送至所述计算节点，并指示所述计算节点创建网关，所述网关配置有上行接口和下行接口，所述网关的上行接口的地址包括所述外部网络的IP地址与所述外部网络的IP地址对应的MAC地址，所述网关的上行接口用于与用户边缘CE路由器的下行接口通信，所述CE路由器的下行接口的地址为所述外部网络对应的网关地址，所述网关的下行接口的地址为所述VM所在的子网对应的网关地址，所述网关的下行接口用于与所述VM所在的子网通信；
    所述处理模块，还用于根据所述外部网络对应的网关地址，所述VM所在的子网的网络ID以及所述外部网络的网络ID生成转发策略，所述转发策略指示所述网关将所述VM发出的第一VPN报文转换为第二VPN报文，所述 第一VPN报文中携带所述VM所在的子网的网络ID，所述第二VPN报文中携带所述外部网络的网络ID，所述转发策略还指示所述网关将所述第二VPN报文通过所述网关的上行接口发送至所述CE路由器的下行接口；
    所述发送模块，还用于将所述转发策略发送至所述计算节点。
  6. 如权利要求5所述的装置，其特征在于，还包括：
    接收模块，用于获取N个子网的子网信息，每个子网的子网信息包括网络ID和IP地址段，N为大于0的整数，所述N个子网均属于所述租户，以及用于获取所述每个子网对应的网关地址，所述外部网络的IP地址段，所述外部网络的网络ID，以及所述外部网络对应的网关地址；
    所述处理模块，具体用于获取所述VM的IP地址，根据所述VM的IP地址确定所述VM所在的子网。
  7. 如权利要求5或6所述的装置，其特征在于，所述处理模块，还用于生成所述VM的路由信息，所述路由信息用于指示所述CE路由器将目的地为所述VM的报文发送至所述网关的上行接口；
    所述发送模块，还用于向所述CE路由器发布所述VM的路由信息。
  8. 如权利要求5至7任一所述的装置，其特征在于，所述处理模块，还用于确定所述计算节点上属于所述租户的全部VM均撤销；
    所述发送模块，还用于指示所述计算节点撤销所述网关。
  9. 一种计算设备，其特征在于，包括处理器、存储器，所述处理器与所述存储器建立通信连接；
    所述处理器用于读取所述存储器中的程序执行如权利要求1至4任一项所述的网关创建方法。
PCT/CN2016/096372 2015-08-25 2016-08-23 一种数据传输方法、虚拟网络管理装置及数据传输*** WO2017032300A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201510526841 2015-08-25
CN201510526841.0 2015-08-25
CN201610698151.8 2016-08-19
CN201610698151.8A CN106487695B (zh) 2015-08-25 2016-08-19 一种数据传输方法、虚拟网络管理装置及数据传输***

Publications (1)

Publication Number Publication Date
WO2017032300A1 true WO2017032300A1 (zh) 2017-03-02

Family

ID=58099587

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/096372 WO2017032300A1 (zh) 2015-08-25 2016-08-23 一种数据传输方法、虚拟网络管理装置及数据传输***

Country Status (1)

Country Link
WO (1) WO2017032300A1 (zh)

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106685835A (zh) * 2017-03-06 2017-05-17 无锡华云数据技术服务有限公司 一种在数据中心的计算节点间实现高速分布式路由的方法
CN110336730A (zh) * 2019-07-09 2019-10-15 腾讯科技（深圳）有限公司 一种网络***及数据传输方法
CN111106991A (zh) * 2018-10-29 2020-05-05 ***通信集团浙江有限公司 一种云专线***及其业务发放和开通方法
WO2020181735A1 (zh) * 2019-03-08 2020-09-17 平安科技（深圳）有限公司 一种提供网络地址转换nat服务的方法及控制器
CN111835876A (zh) * 2019-04-22 2020-10-27 杭州海康威视***技术有限公司 网络地址配置方法、装置、服务器集群及存储介质
CN112242952A (zh) * 2019-07-16 2021-01-19 中移(苏州)软件技术有限公司 一种数据转发方法、柜顶式交换机和存储介质
CN113709200A (zh) * 2020-05-21 2021-11-26 阿里巴巴集团控股有限公司 一种建立通信连接的方法及装置
CN114338397A (zh) * 2021-12-27 2022-04-12 中国联合网络通信集团有限公司 云平台网络配置方法、装置、服务器、存储介质及***
CN115150327A (zh) * 2022-06-29 2022-10-04 济南浪潮数据技术有限公司 一种接口设置方法、装置、设备及介质
CN115412466A (zh) * 2022-08-26 2022-11-29 济南浪潮数据技术有限公司 一种流量监控方法、装置及其介质
WO2023024768A1 (zh) * 2021-08-25 2023-03-02 中兴通讯股份有限公司 Rt-5g路由报文的发布方法、装置、存储介质和电子装置
CN116232997A (zh) * 2023-02-10 2023-06-06 中国联合网络通信集团有限公司 数据转发方法、装置及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120207174A1 (en) * 2011-02-10 2012-08-16 Choung-Yaw Michael Shieh Distributed service processing of network gateways using virtual machines
CN103581324A (zh) * 2013-11-11 2014-02-12 中国联合网络通信集团有限公司 一种云计算资源池***及其实现方法
US20140372582A1 (en) * 2013-06-12 2014-12-18 Dell Products L.P. Systems and methods for providing vlan-independent gateways in a network virtualization overlay implementation
CN104468775A (zh) * 2014-12-05 2015-03-25 国云科技股份有限公司 一种适用于云计算的分布式路由器实现方法
CN104660479A (zh) * 2015-02-13 2015-05-27 南京华讯方舟通信设备有限公司 一种组网方法以及网络***

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120207174A1 (en) * 2011-02-10 2012-08-16 Choung-Yaw Michael Shieh Distributed service processing of network gateways using virtual machines
US20140372582A1 (en) * 2013-06-12 2014-12-18 Dell Products L.P. Systems and methods for providing vlan-independent gateways in a network virtualization overlay implementation
CN103581324A (zh) * 2013-11-11 2014-02-12 中国联合网络通信集团有限公司 一种云计算资源池***及其实现方法
CN104468775A (zh) * 2014-12-05 2015-03-25 国云科技股份有限公司 一种适用于云计算的分布式路由器实现方法
CN104660479A (zh) * 2015-02-13 2015-05-27 南京华讯方舟通信设备有限公司 一种组网方法以及网络***

Cited By (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106685835A (zh) * 2017-03-06 2017-05-17 无锡华云数据技术服务有限公司 一种在数据中心的计算节点间实现高速分布式路由的方法
CN106685835B (zh) * 2017-03-06 2019-06-28 无锡华云数据技术服务有限公司 一种在数据中心的计算节点间实现高速分布式路由的方法
CN111106991A (zh) * 2018-10-29 2020-05-05 ***通信集团浙江有限公司 一种云专线***及其业务发放和开通方法
CN111106991B (zh) * 2018-10-29 2022-05-06 ***通信集团浙江有限公司 一种云专线***及其业务发放和开通方法
WO2020181735A1 (zh) * 2019-03-08 2020-09-17 平安科技（深圳）有限公司 一种提供网络地址转换nat服务的方法及控制器
CN111835876A (zh) * 2019-04-22 2020-10-27 杭州海康威视***技术有限公司 网络地址配置方法、装置、服务器集群及存储介质
CN110336730A (zh) * 2019-07-09 2019-10-15 腾讯科技（深圳）有限公司 一种网络***及数据传输方法
CN112242952A (zh) * 2019-07-16 2021-01-19 中移(苏州)软件技术有限公司 一种数据转发方法、柜顶式交换机和存储介质
CN113709200A (zh) * 2020-05-21 2021-11-26 阿里巴巴集团控股有限公司 一种建立通信连接的方法及装置
CN113709200B (zh) * 2020-05-21 2023-11-28 阿里巴巴集团控股有限公司 一种建立通信连接的方法及装置
WO2023024768A1 (zh) * 2021-08-25 2023-03-02 中兴通讯股份有限公司 Rt-5g路由报文的发布方法、装置、存储介质和电子装置
CN114338397B (zh) * 2021-12-27 2023-11-03 中国联合网络通信集团有限公司 云平台网络配置方法、装置、服务器、存储介质及***
CN114338397A (zh) * 2021-12-27 2022-04-12 中国联合网络通信集团有限公司 云平台网络配置方法、装置、服务器、存储介质及***
CN115150327A (zh) * 2022-06-29 2022-10-04 济南浪潮数据技术有限公司 一种接口设置方法、装置、设备及介质
CN115412466A (zh) * 2022-08-26 2022-11-29 济南浪潮数据技术有限公司 一种流量监控方法、装置及其介质
CN116232997A (zh) * 2023-02-10 2023-06-06 中国联合网络通信集团有限公司 数据转发方法、装置及存储介质
CN116232997B (zh) * 2023-02-10 2024-04-09 中国联合网络通信集团有限公司 数据转发方法、装置及存储介质

Similar Documents

Publication Publication Date Title
WO2017032300A1 (zh) 一种数据传输方法、虚拟网络管理装置及数据传输***
US11588886B2 (en) Managing replication of computing nodes for provided computer networks
CN106487695B (zh) 一种数据传输方法、虚拟网络管理装置及数据传输***
US10645056B2 (en) Source-dependent address resolution
JP6483781B2 (ja) 分散論理ｌ３ルーティング
US10164881B2 (en) Route advertisement by managed gateways
US9225597B2 (en) Managed gateways peering with external router to attract ingress packets
US10320895B2 (en) Live migration of load balanced virtual machines via traffic bypass
JP5763081B2 (ja) 仮想化ネットワークインフラストラクチャを用いたトランスペアレントなクラウドコンピューティングのための方法および装置
US8804745B1 (en) Virtualization mapping
CN111492627B (zh) 为不同应用建立不同隧道的基于控制器的服务策略映射
RU2595540C9 (ru) Базовые контроллеры для преобразования универсальных потоков
US9936014B2 (en) Method for virtual machine migration in computer networks
US9923800B2 (en) Method for reachability management in computer networks
CN107113241B (zh) 路由确定方法、网络配置方法以及相关装置
WO2022001669A1 (zh) 建立vxlan隧道的方法及相关设备
WO2020108587A1 (zh) 数据处理方法、控制器和转发设备
WO2019184653A1 (zh) 链路配置方法和控制器
WO2021098727A1 (zh) 网络部署的方法及***
WO2022110535A1 (zh) 一种报文发送方法、设备及***
WO2018045992A1 (zh) 地址管理方法及装置
US20220086040A1 (en) Systems and methods for zero-touch provisioning of a switch in intermediate distribution frames and main distribution frames
JP7388533B2 (ja) ゲートウェイ装置、方法及びプログラム
EP3210113B1 (en) Virtual overlay mobility using label based underlay network forwarding
US10257118B2 (en) Implementation method and device for VLAN to access VF network, and FCF

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16838558

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16838558

Country of ref document: EP

Kind code of ref document: A1