CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of Chinese Patent Application No. 201810670379.5, filed on Jun. 26, 2018, which are hereby incorporated by reference in their entireties.

TECHNICAL FIELD

This application relates to the field of computers and communications technologies, and in particular, to a Virtual eXtensible Local Area Network (VXLAN) implementation method, a network device, and a communications system.

BACKGROUND

In a VXLAN, a device implementing a VXLAN packet encapsulation or decapsulation function is referred to as a VXLAN tunnel end point (VTEP). The VTEP encapsulates a layer 2 packet into a transport layer protocol (for example, User Datagram Protocol (UDP)) packet to implement VXLAN packet encapsulation. The VTEP may be a server, or may be a network device (for example, a switch or a router).

In a campus network, terminal devices generally do not support a VXLAN. Therefore, the function of the VTEP is implemented by an access device. However, there are many access devices in the campus network. If all the access devices are required to support a VXLAN, overall deployment costs in the campus network are excessively high.

SUMMARY

This application provides a VXLAN implementation method, to reduce overall deployment costs of a VXLAN in a campus network.

According to a first aspect, a VXLAN implementation method is provided. The method includes the following. A network device obtains a mapping from a Virtual Local Area Network (VLAN) identifier (ID) to a VXLAN network identifier (VNI). The network device receives, through a port, an Ethernet frame forwarded by an access device. A VLAN tag field in the Ethernet frame includes the VLAN ID. The network device adds a VXLAN header to the Ethernet frame based on the VLAN ID and the mapping to obtain a VXLAN packet. A VNI field in the VXLAN header includes the VNI. The network device sends the VXLAN packet.

In this application, a VTEP device is the network device connected to the access device. In other words, the VTEP device is a device farther from a terminal device than the access device. Usually, there are fewer devices farther from the terminal device. In this solution, the access device does not need to support a VXLAN, and only a relatively small quantity of network devices need to support a VXLAN such that a large quantity of access devices in a campus network that do not support a VXLAN can still be used. Therefore, deployment costs of a VXLAN technology in the campus network are relatively low. However, because the network device is not directly connected to the terminal device, making it difficult to directly select the VNI for the Ethernet frame, the access device selects the VLAN ID for the Ethernet frame from the terminal device, and the network device stores the mapping from a VLAN ID to a VNI. After receiving the Ethernet frame from the access device, the network device adds the corresponding VXLAN header to the Ethernet frame based on the mapping from a VLAN ID to a VNI to obtain the VXLAN packet, thereby implementing a VXLAN.

If the access device serves as an authenticator, in an authentication process, the network device obtains no VLAN ID authorized by an authentication server. To ensure normal forwarding of an Ethernet frame in a network, a port that is on the network device and that is connected to the access device needs to be added (add) to an authorized VLAN of a terminal device that accesses a network using the access device. In an implementation process, there are a plurality of specific adding manners. For example, the port on the network device is added to all VLANs.

In a possible implementation of the first aspect, another manner of adding a port to an authorized VLAN of a terminal device by the network device is provided. In an embodiment, the method further includes the following. The network device receives an adding instruction from the access device through the port. The adding instruction includes the VLAN ID. The network device adds the port to a VLAN identified by the VLAN ID. In this manner of adding the port on the network device to the VLAN, a range of a broadcast domain can be controlled, thereby improving security.

In another possible implementation of the first aspect, the adding instruction is a first Locator/Identifier Separation Protocol (LISP).

Optionally, the first LISP packet further carries a first packet type indicator, and the first packet type indicator indicates that the first LISP packet includes the VLAN ID. With the packet type indicator, the network device can efficiently identify a purpose of the LISP packet, in other words, identify a type of information included in the LISP packet, to perform corresponding processing.

In another possible implementation of the first aspect, the method further includes the following. The network device receives a first authentication packet from the access device through the port. The first authentication packet is used in authentication for a supplicant device. The network device records a correspondence between the port and a supplicant device address in the first authentication packet. The network device receives a second authentication packet from an authentication server. The second authentication packet includes the supplicant device address and the VLAN ID. The network device adds the port to a VLAN identified by the VLAN ID, based on the supplicant device address and the VLAN ID in the second authentication packet and the recorded correspondence between the supplicant device address and the port. In this manner, the network device actually serves as an authenticator device such that a large quantity of access devices closer to a terminal device do not need to support an authentication function. Therefore, simpler and lower-cost hardware can be used for implementation, thereby reducing deployment costs.

In another possible implementation of the first aspect, the network device sends a binding instruction to the access device. The binding instruction includes the supplicant device address and the VLAN ID. With the binding instruction, the access device adds a port connected to a terminal device to an authorized VLAN of the terminal device, and adds a proper VLAN ID to a subsequent Ethernet frame sent by the terminal device.

Optionally, the first authentication packet is encapsulated into a first LISP packet, the first LISP packet further carries a first packet type indicator, and the first packet type indicator indicates that the first LISP packet carries the authentication packet. The binding instruction is a second LISP packet, the second LISP packet further includes a second packet type indicator, and the second packet type indicator indicates that the second LISP packet includes a Media Access Control (MAC) address and a VLAN ID of the terminal device.

According to a second aspect, a VXLAN implementation method is provided. The method includes the following. An authenticator device obtains a VLAN ID allocated by an authentication server to an authenticated supplicant device. The authenticator device sends an LISP packet to a VXLAN tunnel end point VTEP device. The LISP packet includes the VLAN ID. The authenticator device and the VTEP device are implemented by different devices. For example, the authenticator device is an access device, and the VTEP device is a network device connected to the access device. The authenticator device sends the VLAN ID of the supplicant device to the VTEP device after authentication succeeds such that the VTEP device adds a port of the VTEP device to a specified VLAN, to control a range of a broadcast domain and improve security.

In a possible implementation, the method further includes the following. The authenticator device determines a port connected to a MAC address of the supplicant device. The authenticator device sets a value of a default VLAN of the port to the VLAN ID. The authenticator device receives an Ethernet frame from the supplicant device through the port. The authenticator device adds a VLAN tag including the VLAN ID to the Ethernet frame based on the default VLAN of the port, and then forwards the Ethernet frame. The authenticator device adds the VLAN ID to the VLAN tag in the Ethernet frame such that the VTEP device obtains a mapped VNI based on the VLAN ID in the VLAN tag in the Ethernet frame, and adds a VXLAN header to the Ethernet frame, to implement a VXLAN.

In a possible implementation, the LISP packet further includes a packet type indicator, and the packet type indicator is used to instruct the VTEP device to add a port receiving the LISP packet to a VLAN identified by the VLAN ID. With the packet type indicator, the network device can efficiently identify a purpose of the LISP packet, in other words, identify a type of information included in the LISP packet, to perform corresponding processing.

According to a third aspect, a VXLAN implementation method is further provided. The method includes the following. An access device receives an authentication packet from a terminal device through a port. The terminal device is a to-be-authenticated supplicant device. The access device records a correspondence between the port and a MAC address, in the authentication packet, of the supplicant device. The access device sends the authentication packet to a network device. The network device is an authenticator device and a VXLAN tunnel end point VTEP device. The access device receives a binding instruction from the network device. The binding instruction includes the MAC address of the supplicant device and a VLAN ID. The access device sets a value of a default VLAN of the port to the VLAN ID based on the correspondence and the MAC address, in the binding instruction, of the supplicant device. In this solution, the network device connected to the access device serves as both the authenticator device and the VTEP device, the access device forwards the authentication packet between the authenticator device and the to-be-authenticated supplicant device, and after authentication succeeds, the access device adds the port connected to the supplicant device to an authorized VLAN according to the binding instruction, to control access of the supplicant device based on the authorized VLAN.

In a possible implementation, the method further includes the following. The access device receives an Ethernet frame from the terminal device through the port. A source address of the Ethernet frame is the MAC address of the supplicant device. The access device adds a VLAN tag including the VLAN ID to the Ethernet frame based on the default VLAN of the port, and then forwards the Ethernet frame. The access device adds the VLAN ID to the VLAN tag in the Ethernet frame such that the VTEP device obtains a mapped VNI based on the VLAN ID in the VLAN tag in the Ethernet frame, and adds a VXLAN header to the Ethernet frame, to implement a VXLAN.

In a possible implementation, that the access device sends the authentication packet to a network device includes the following. The access device encapsulates the authentication packet using a first LISP packet, and the access device sends the first LISP packet to the network device. The authentication packet between the access device and the network device is encapsulated using the LISP packet, thereby providing a feasible manner for packet authentication through transparent transmission.

In a possible implementation, the first LISP packet further carries a first packet type indicator, and the first packet type indicator indicates that the first LISP packet carries the authentication packet.

In a possible implementation, the binding instruction is a second LISP packet, the second LISP packet further includes a second packet type indicator, and the second packet type indicator indicates that the second LISP packet includes the MAC address of the terminal device and the VLAN ID. When an LISP packet can carry various types of information to implement a plurality of purposes, with the packet type indicator, the network device can efficiently identify a purpose of a received LISP packet, in other words, identify a type of information included in the received LISP packet, to perform corresponding processing.

According to a fourth aspect, a network device is provided. The network device is connected to an access device. The network device includes a memory, a port, and at least one processor. The memory is configured to store program code.

The at least one processor is configured to perform the method in any one of the first aspect or the possible implementations of the first aspect after reading the program code stored in the memory. For details, refer to the foregoing detailed description. Details are not described herein again.

According to a fifth aspect, an access device is provided. The access device includes a memory, a port, and at least one processor. The memory is configured to store program code.

The at least one processor is configured to perform the method in any one of the second aspect or the possible implementations of the second aspect or perform the method in any one of the third aspect or the possible implementations of the third aspect after reading the program code stored in the memory. For details, refer to the foregoing detailed description. Details are not described herein again.

According to a sixth aspect, a VXLAN implementation apparatus is provided, to perform the method in any one of the first aspect or the possible implementations of the first aspect, or perform the method in any one of the second aspect or the possible implementations of the second aspect, or perform the method in any one of the third aspect or the possible implementations of the third aspect. The VXLAN implementation apparatus includes a unit configured to perform the method in any one of the first aspect or the possible implementations of the first aspect, or includes a unit configured to perform the method in any one of the second aspect or the possible implementations of the second aspect, or includes a unit configured to perform the method in any one of the third aspect or the possible implementations of the third aspect. These units may be implemented by a program module, or may be implemented by hardware or firmware.

According to a seventh aspect, this application provides a computer-readable storage medium. The computer-readable storage medium is configured to store a computer software instruction to be used by the foregoing network device, and when the computer software instruction runs on a computer, the computer performs the method in any one of the first aspect or the possible implementations of the first aspect. Alternatively, the computer-readable storage medium is configured to store a computer software instruction to be used by the foregoing access device, and when the computer software instruction runs on a computer, the computer performs the method in any one of the second aspect or the possible implementations of the second aspect, or the computer performs the method in any one of the third aspect or the possible implementations of the third aspect.

According to an eighth aspect, a computer program product including an instruction is provided. When the instruction runs on a computer, the computer performs the method in each of the foregoing aspects.

According to a ninth aspect, a communications system is provided. The system includes an access device and a network device connected to the access device. The network device is configured to perform the method in any one of the first aspect or the possible implementations of the first aspect.

In a possible implementation, the access device is configured to perform the method in any one of the second aspect or the possible implementations of the second aspect.

In a possible implementation, the access device is configured to perform the method in any one of the third aspect or the possible implementations of the third aspect.

