In some industries, such as finance, a data center stores, manages, and disseminates its data, it houses most critical systems and is vital to the continuity of daily operations. The reliability of the data center directly determines whether the services can be sustainably and reliably operated. In consideration of factors such as power outage and nature disasters like earthquakes, generally three data centers are required to be constructed at three geographic locations, i.e., two data centers within one city, and the third one in another city which is relatively distant from the first city. Generally, two data centers that are constructed within one city work as redundant data centers which back up each other in real-time. The third data center that is constructed in the other city works as disaster recovery. The two data centers in the same city form active-active redundant data centers, i.e., the two data centers operate simultaneously to provide services to the outside and are mutually standbys.
As illustrated in FIG. 1, in an existing standalone data center, a firewall 102′ can realize security protection of north-south traffic (traffic between the Internet and host 104′, which passes through a router 101′, the firewall 102′, a switch 103′ and the host 104′), and security protection of east-west traffic (secure layer-3 traffic across local area networks between hosts, e.g., traffic for a host with IP 192.168.10.2 in a local area network 105′ to access a host with IP 192.168.20.2 in a local area network 106′).
In order to facilitate migration of services between two data centers, the two data centers are interconnected through layer-2 VLANs extended by leveraging layer3 or MPLS tunnels (also called as large layer-2 connectivity of data centers) to realize layer-2 interconnection between the two data centers, i.e., the two data centers are intercommunicated on layer 2, and one virtual machine can non-disruptively operate and provide corresponding services without changing an IP address and routing configurations after migrating from one data center to another data center.
As illustrated in FIG. 2, a layer-2 extension device 205′ is added in each data center, and each data center further comprises a router 201′, a firewall 202′, a switch 203′, hosts 204′, a local area network 206′ and a local area network 207′. As of now, there are multiple solutions to provide the layer-2 extension between the data centers, such as Overlay Transport Virtualization (OTV) solution and Ethernet Virtual Network (EVN) solution. The fundamental idea is to enable the two data centers to be intercommunicated through extended layer-2 networks, such that when two hosts in the same local area network access each other, the geographic locations of the hosts become transparent and the IP address does not need to be changed when a host migrates across data centers.
The same local area network has the same gateway address in both side of data centers (e.g., the address of the gateway of the local area network 206′ of the left data center is 192.168.10.1, and the address of the gateway of the local area network 206′ of the right data center is also 192.168.10.1). This is equivalent to that there are two identical IP addresses in the same local area network. If no special treatment is performed, IP address conflict will occur. To solve this problem, the layer-2 extension device (device 205, as mentioned before) supports a function, called ARP filtering, which can block an ARP packet with a designated IP address from interchanging between two data centers. In actual deployment, the layer-2 extension device may be configured to filter an ARP packet with a gateway IP address. In this way, the ARP packet of the gateway will not be forwarded across data centers so that the hosts in a data center should always use the gateway that is located in the same data center as their default gateway.
Firewall deployment in each side of redundant data center is same as that of a standalone data center. However, after two data centers are interconnected through layer-2 extension and form a redundant data center, they won't work if firewalls of the two data centers keep working independently, for the reason that asymmetrical routing exists in traffic across layer-2 networks and across data centers. For the same connection, one firewall in one data center of a redundant data centers can only receive traffic in one direction, and the other firewall in the other data center can only receive traffic in the other direction if the connection is between two hosts in two different layer-2 networks and in two data centers. As we all know that the firewall performs stateful inspections, if the firewall cannot receive traffic of the same connection in both directions, the firewall cannot perform correct processing on the flow.
Taking a situation, in which the host (referred to as host A) with IP 192.168.10.2 of the local area network 206′ in the left data center accesses the host (referred to as host B) with IP 192.168.20.4 of the local area network 207′ in the right data center, as an example, when host A sends TCP SYN packet to host B, the TCP SYN packet passes sequentially through following devices: L2 switch next to host A, the firewall of the left data center, then returns to the switch, passes to layer-2 extension device, sends to the router, reaches the right data center, passes through the router, the layer 2 extension device, passes to switch of the right data center and then reaches the host B. Host B returns a TCP SYN ACK packet to host A after receiving the TCP SYN packet. The TCP SYN ACK packet passed sequentially through these units: the switch next to host B, the firewall of the right data center, then returns to the switch, the layer-2 extension device, the router, then reaches the left data center, then passes through the router, the switch and finally reaches the host A. The firewall of the left data center only processes the TCP SYN packet from host A to host B, and the firewall of the right data center only processes the TCP SYN ACK packet from host B to host A, which is equivalent to that the firewalls on two sides only receive a data packet in a single direction. Under this situation, the security processing function of the firewall cannot work normally, and the subsequent data packets which are sent by the host A and the host B again will be discarded by the firewalls.
Up to now, no effective solution has been provided to solve this technical problem that stateful security service for active-active redundant data centers cannot cooperatively work in the related art.