CN104954186A - Application-oriented SDN (software defined network) strategy control method - Google Patents

Abstract

The invention discloses an application-oriented SDN (software defined network) strategy control method. The application-oriented SDN strategy control method comprises the following steps of partitioning application terminal system TE (terminal equipment) with similar strategy demands into the same TG (terminal group) by an SDN basic control environment which consists of an SDN strategy controller, an SDN intelligent switch and basic application system TE; encapsulating flow in an SDN in a VXLAN (virtual extensible local area network) for transmission by an overlay encapsulation technology, and adding new TG markers to extension VXLAN headers so as to distinguish different strategy groups. The application-oriented SDN strategy control method disclosed by the invention has the beneficial effects that based on the SDN basic environment, through the extended VXLAN technology and the added strategy group markers, a relation of a physical location, a safety strategy and an IP (internet protocol) address is separated, therefore servers can be deployed and transferred more conveniently; by setting a safety control strategy, the automation performance and the safety management performance of the SDN are improved.

Description

An application-oriented SDN network policy control method

Technical field The present invention is applicable to the research of software-defined network technology under the data center and wide area network, and belongs to the field of software and network technology.

Background technique

The development of SDN is in full swing. With the introduction and rapid development of the SDN concept, enterprises have higher and higher expectations for SDN, including improving network utilization, automatic configuration management, improving security performance, application visualization, reducing complexity, reducing operating costs, and improving scalability. , Support the creation of private clouds and hybrid clouds, etc. Most of them are related to the operation and maintenance of data centers. Through SDN, a more flexible and efficient data center network can be created to provide better IT infrastructure support for business applications.

In the data center application deployment and operation and maintenance, the new deployment of the server, the deployment strategy involves the information configuration of each node of the network, which is relatively cumbersome. In a Layer 2 network environment, the IP and MAC addresses before and after migration remain unchanged. When migrating across different computer rooms or regions, a large Layer 2 network must be implemented, which is prone to loops and broadcast storms, making it difficult to manage. At the same time, it is not easy to implement access policies in the same VLAN, and the access control policies for different applications are more complicated. The above problems are pressing problems facing the data center.

Contents of the invention

In order to solve the above problems, the present invention provides an application-oriented SDN network policy control method, including the SDN infrastructure environment and its network policy control method, so as to realize the application deployment and operation and maintenance of the data center, the physical location , Security policy and network IP address are decoupled to improve the automation performance and security management performance of SDN.

The technical solution of the present invention is: an application-oriented SDN network policy control method, including an SDN basic environment composed of an SDN policy controller, an SDN smart switch, and a basic application system in which the infrastructure includes,

As a centralized policy management center, the SDN policy controller globally controls network application policy information;

The SDN smart switch can analyze and execute the policy information issued by the SDN policy controller;

The basic application system includes server bare metal, virtual machine or application entity services. The basic application system node is marked as a TE, and TEs with similar network application strategies are divided into the same group according to application requirements, called TG;

Using Overlay multi-encapsulation technology, the traffic in the SDN network is encapsulated in VXLAN for transmission, the MAC or IP of the basic application system node is mapped to VETP, and the VXLAN header is extended to add a new TG identifier, and the physical location, security policy and network IP address Decoupling;

When the above-mentioned SDN policy controller performs policy management, the granularity of new server migration and network security policy is TG, and the access control policy between TGs is represented by {Cij, Rij}, where Cij represents the connection relationship of TGs, and Rij represents the TG visit relationship.

When the above-mentioned SDN policy controller performs policy management, it sends the TG identification to server management platforms such as KVM and VCENTER through the API interface, and identifies the policy group to which the terminal application system node belongs;

According to the above control method, take the following steps:

S1. Initialize the SDN basic environment;

S2. In the SDN policy controller, divide the TG identification and issue the TG identification through the API, and distinguish the policy group to which the terminal application system node belongs;

S3. According to the application system access relationship and security policy requirements, configure the access control policy {Cij, Rij} in the SDN policy controller;

S4. After the application system is connected to the SDN smart switch, bind the corresponding TG according to the policy group to which it belongs;

S5. When the data of the application system is forwarded, the data packets arriving at the SDN smart switch are encapsulated by the extended VXLAN with the added TG mark and then forwarded.

S6. The SDN policy controller delivers the access control policy between TGs to the SDN smart switch;

The S7.SDN smart switch parses and executes access control policies.

Beneficial effects of the present invention: Based on the SDN basic environment, the present invention separates the relationship between physical location, security policy and IP address by extending VXLAN technology and adding policy group identifiers, so that it is more convenient to deploy and migrate servers, set security control policies, and improve SDN Automation performance and safety management performance.

Description of drawings

FIG. 1 is a structural diagram of SDN physical components used in the present invention.

Fig. 2 is a component model of the SDN network policy used in the present invention.

Fig. 3 is an example of TG division used in the present invention.

Figure 4 is a mapping diagram of extended VXLAN packets and original data packets.

Detailed ways

The present invention will be further described below in conjunction with accompanying drawing and specific embodiment:

In order to facilitate those of ordinary skill in the art to understand the principle of the present invention, the working process, at first important words used in the present invention are defined as follows:

(1) SDN: Software Defined Network, software defined network

(2) TE: Terminal Equipment, application terminal node

(3) TG: Terminal Group, application terminal node group

(4) eVXLAN: extended VXLAN, extended according to some reserved fields of the standard VXLAN protocol

(5) VTEP: VXLAN Tunneling End Point, VXLAN tunnel terminal, used for encapsulation and decapsulation of multiple VXLAN packets, including MAC request packets and normal VXLAN data packets. The data center network is gradually increasing, and the difficulty of operation and maintenance is increasing. For example, the application server deployment strategy in the data center involves the information configuration of each node in the network, which is relatively cumbersome; in the two-layer network environment, the IP and MAC addresses before and after migration remain unchanged. When migrating across different computer rooms or regions, large Layer 2 networks are prone to loops and broadcast storms, which are difficult to manage. At the same time, it is not easy to implement access policies under the same VLAN, and the access control policies for different applications are more complicated. The above problems are pressing problems facing the data center.

The development of SDN has become popular all over the world in recent years. The concept is separation of hardware and software, separation of control and forwarding, centralized management and control, and open source, which will bring low cost, high efficiency, and business flexibility. Solving the above problems by means of SDN is the formal design of the present invention based on the above considerations.

The application-oriented SDN network policy control method of the present invention will be described below with specific examples.

As shown in FIG. 1 , the present invention is based on an SDN network system, including an SDN basic environment composed of an SDN policy controller, an SDN smart switch, and a basic application system. The SDN smart switch includes a core switch (Core) and an access switch (Access). The traffic between the two is encapsulated by VXLAN, and the access switch is also the tunnel terminal of VXLAN. Access switches downlink basic application systems, including physical machines, virtual machines, etc. The Controller acts as an SDN policy controller as a centralized policy management center, and globally controls network application policy information.

When the SDN policy controller performs policy scheduling, it needs to abstract all managed objects, establish an object resource pool, and schedule objects in the resource pool by formulating policies. As shown in Figure 2, the abstract SDN network policy component model includes Controller representing the SDN policy controller, SW representing the SDN smart switch, and TG representing the application terminal node group for policy functions. When the SDN policy controller performs policy management, it marks the application system as a TE (Terminal Equipment), and divides a group of similar TEs into the same group, which is called TG (Terminal Group).

The SDN policy controller will send the TG logo to KVM, VCENTER and other server management platforms through the open API interface to identify the service node. For example, mark each virtual machine in VCENTER by sending the Network Group to VCENTER.

Figure 3 shows a typical application deployment architecture. Users use the WEB system, APP and DB as the background system. This system can be divided into four TGs according to actual needs, namely TG-User, TG-Web, TG-App, TG-DB, and subsequent security policies are executed with TG as the object.

The granularity of server new migration and network security policy is TG, and TG is represented by {Cij, Rij}, where Cij represents the connection relationship of TG, and Rij represents the mutual access relationship of TG. Cij=0 means that there is no connection relationship between the two EPGs, and Cij=1 means that there is a connection relationship between the two EPGs. The Rij example is expressed as {Filter:TCP source port X,destination port Y; Qos:Q1|Q2|Q3|…}, which means that the EPG-outside source port X can only access the EPG-Web destination port Y; the QoS for access requires passing QoS Levels are identified.

As shown in Fig. 4, when the message of the present invention is forwarded in the SDN environment, the Overlay multiple encapsulation technology is used to encapsulate the traffic in the SDN network in the VXLAN. The lower part of the figure shows data packets in various formats sent and received by the basic application system; as shown in the upper part of the figure, when they arrive at the smart access switch, they need to be encapsulated and added with a VXLAN header. Through the encapsulation of the new message, the location of the server is decoupled from the network IP address, making the location and address of the server irrelevant, and improving the flexibility of application deployment and migration.

At the same time, by extending the VXLAN packet header to add a TG identifier, all security policies are executed with the TG as the object, instead of using the traditional access control list. By flexibly dividing TGs, security policies can be adjusted more flexibly, and security control can be enhanced.

According to the above control method, take the following steps:

S1. Initialize the SDN basic environment;

S2. In the SDN policy controller, divide the TG identification and issue the TG identification through the API, and distinguish the policy group to which the terminal application system node belongs;

S3. According to the application system access relationship and security policy requirements, configure the access control policy {Cij, Rij} in the SDN policy controller;

S4. After the application system is connected to the SDN smart switch, bind the corresponding TG according to the policy group to which it belongs;

S5. When the data of the application system is forwarded, the data packets arriving at the SDN smart switch are encapsulated by the extended VXLAN with the added TG mark and then forwarded.

S6. The SDN policy controller delivers the access control policy between TGs to the SDN smart switch;

The S7.SDN smart switch parses and executes access control policies.

Claims (1)

1. An application-oriented SDN network policy control method, characterized in that, comprising: an SDN basic environment composed of an SDN policy controller, an SDN smart switch, and a basic application system, wherein, As a centralized policy management center, the SDN policy controller globally controls network application policy information; The SDN smart switch can analyze and execute the policy information issued by the SDN policy controller; The basic application system includes server bare metal, virtual machine or application entity services. The basic application system node is marked as a TE, and TEs with similar network application strategies are divided into the same group according to application requirements, called TG; Using Overlay multi-encapsulation technology, the traffic in the SDN network is encapsulated in VXLAN for transmission, the MAC or IP of the basic application system node is mapped to VETP, and the VXLAN header is extended to add a new TG identifier, and the physical location, security policy and network IP address Decoupling; Send the TG logo to server management platforms such as KVM and VCENTER through the API interface, and identify the policy group to which the terminal application system node belongs; The granularity of server new migration and network security policy is TG, and the access control policy between TGs is represented by {Cij, Rij}, where Cij represents the connection relationship of TGs, and Rij represents the mutual access relationship of TGs. According to the above method, take the following steps: S1. Initialize the SDN basic environment; S2. In the SDN policy controller, divide the TG identification and issue the TG identification through the API, and distinguish the policy group to which the terminal application system node belongs; S3. According to the application system access relationship and security policy requirements, configure the access control policy {Cij, Rij} in the SDN policy controller; S4. After the application system is connected to the SDN smart switch, bind the corresponding TG according to the policy group to which it belongs; S5. When the data of the application system is forwarded, the data packets arriving at the SDN smart switch are encapsulated by the extended VXLAN with the added TG mark and then forwarded. S6. The SDN policy controller delivers the access control policy between TGs to the SDN smart switch; The S7.SDN smart switch parses and executes access control policies.