WO2016107261A1

WO2016107261A1 - Method for accessing vpn service, and network device

Info

Publication number: WO2016107261A1
Application number: PCT/CN2015/093091
Authority: WO
Inventors: 于德雷; 赖晓
Original assignee: 华为技术有限公司
Priority date: 2014-12-31
Filing date: 2015-10-28
Publication date: 2016-07-07
Also published as: CN104601431B; CN104601431A

Abstract

Provided are a method for accessing a VPN service, and a network device. The method comprises: a network device receiving a first access request sent by a first edge device, wherein the first access request is used for requesting to provide a first user website connected to the first edge device with access to the VPN service; determining that a second user website requests to access the VPN service; and configuring the first edge device and a second edge device that is connected to the second user website, so as to make the first user website and the second user website access the VPN service. It can be seen that, in the present invention, when it is determined that the first user website can transmit data with the second user website after accessing the VPN service, then the first user website and the second user website can access the VPN service, thereby avoiding the occurrence of the situation where the resources of the first edge device are occupied but the first user website cannot transmit data as far as possible, and therefore resource waste is reduced.

Description

VPN service access method and network device

This application claims the priority of the Chinese Patent Application filed on Dec. 31, 2014, the Chinese Patent Office, the application number is CN 201410850003.4, and the invention is entitled "Access Method and Network Device for VPN Service". Combined in this application.

Technical field

The present invention relates to communication technologies, and in particular, to a VPN service access method and a network device.

Background technique

Virtual Private Network (English: Virtual Private Network, VPN) is a technology for constructing a private network on a public data network. These private networks are isolated from each other, and data of one private network is not transmitted to another private network. In order to make the data transmission between the user sites using the VPN, the user site needs to first access the VPN service.

The current practice of the user site accessing the VPN service is that the operator and the user manually negotiate all the user sites that need to access the VPN service, and then manually configure the edge devices respectively connected to each of the user sites, thereby Each of the user sites is connected to the VPN service.

However, since the user equipment needs to configure the edge device connected to the user site when accessing the VPN service, the resource of the edge device is inevitably occupied, and in the foregoing access mode, the user site cannot access the VPN service on demand, That is to say, even if the user station cannot transmit data after accessing the VPN service, the operator still accesses the user site to the VPN service, thereby causing waste of resources.

Summary of the invention

The technical problem to be solved by the present invention is to provide a VPN service access method and a network device, so as to implement a user site to access the VPN service on demand, thereby reducing resource waste.

To this end, the technical solution of the present invention to solve the technical problem is:

In a first aspect, the present invention provides a method for accessing a virtual private network VPN service, including:

Receiving, by the network device, a first access request sent by the first edge device, where the first access request is used to request that the first user station connected to the first edge device access the VPN service;

Determining, by the network device, that the second user station requests to access the VPN service;

The network device configures the first edge device and a second edge device connected to the second user site to access the VPN service by the first user site and the second user site.

In a first possible implementation manner of the first aspect, the network device configures the first edge device and a second edge device that is connected to the second user site, to use the first user site and the The second user site accesses the VPN service, including:

The network device deploys a first VPN tunnel from the first edge device to the second edge device, and deploys a second VPN tunnel from the second edge device to the first edge device, where A head end of a VPN tunnel is associated with the first port, a tail end of the first VPN tunnel is associated with the second port, and a head end of the second VPN tunnel is associated with the second port, The second port of the second VPN tunnel is associated with the first port, the first port is a port connected to the first user site on the first edge device, and the second port is the second edge The port on the device that is connected to the second user site.

In conjunction with the first possible implementation of the first aspect, in a second possible implementation of the first aspect, the method further includes:

Receiving, by the network device, a second access request sent by the third edge device, where the second access request is used to request that the third user station connected to the third edge device access the VPN service;

Determining, by the network device, that the first user site and the second user site access the VPN service;

The network device deploys a third VPN tunnel from the first edge device to the third edge device, and deploys a fourth VPN tunnel from the third edge device to the first edge device, the first The head end of the third VPN tunnel is associated with the first port, the tail end of the third VPN tunnel is associated with the third port, and the head end of the fourth VPN tunnel is associated with the third port, the fourth The trailing end of the VPN tunnel is associated with the first port, and the third port is a port connected to the third user station on the third edge device;

The network device deploys a fifth VPN tunnel from the second edge device to the third edge device, and deploys a sixth VPN tunnel from the third edge device to the second edge device, where the The head end of the fifth VPN tunnel is associated with the second port, the tail end of the fifth VPN tunnel is associated with the third port, and the head end of the sixth VPN tunnel is associated with the third port, The tail end of the sixth VPN tunnel is associated with the second port.

In conjunction with the first or second possible implementation of the first aspect, in a third possible implementation of the first aspect, the method further includes:

The network device allocates a VPN tunnel identifier to the VPN service;

The network device deploys a first VPN tunnel from the first edge device to the second edge device, and deploys a second VPN tunnel from the second edge device to the first edge device, including:

The network device sends a first configuration parameter to the first edge device, where the first configuration parameter includes: the VPN tunnel identifier, the port identifier of the first port, and the device identifier of the second edge device ;

The network device sends a second configuration parameter to the second edge device, where the second configuration parameter includes: the VPN tunnel identifier, the port identifier of the second port, and the device identifier of the first edge device .

In conjunction with the first or second possible implementation of the first aspect, in a fourth possible implementation of the first aspect, the network device is deployed from the first edge device to the second edge device The first VPN tunnel, and the second VPN tunnel from the second edge device to the first edge device, including:

The network device sends a request for deploying the first VPN tunnel and the second VPN tunnel to a controller, where the request for deploying the first VPN tunnel and the second VPN tunnel includes the first port The port identifier, the port identifier of the second port, the device identifier of the first edge device, and the device identifier of the second edge device.

With reference to any one of the first to fourth possible implementations of the first aspect, in a fifth possible implementation of the first aspect, the method further includes:

Receiving, by the network device, a first exit request sent by the first edge device or a second exit request sent by the second edge device, where the first exit request is used to request to withdraw the first user site from the a VPN service, where the second exit request is used to request that the second user site exit the VPN service;

The network device revokes the first VPN tunnel and the second VPN tunnel.

In conjunction with the fifth possible implementation of the first aspect, in a sixth possible implementation manner of the first aspect, the method further includes:

Obtaining, by the network device, a part for indicating the first VPN tunnel and the second VPN tunnel Information about the time of the department;

The network device sends the related information to the charging device.

With reference to the first to sixth possible implementation manners of the first aspect, in a seventh possible implementation manner of the first aspect, the first access request further includes the first user site request Accessing the account of the VPN service;

The method further includes:

Obtaining, by the network device, a quality of service QoS corresponding to the account;

The network device deploying the first VPN tunnel from the first edge device to the second edge device, including:

The network device deploys the first VPN tunnel from the first edge device to the second edge device based on the QoS corresponding to the account.

With reference to the first aspect, the first to the seventh possible implementation manners of the first aspect, in an eighth possible implementation manner of the first aspect, the method further includes:

After receiving the first access request, the network device stores information that the first user station requests to access the VPN service;

The network device determines that the second user site requests to access the VPN service, including:

The network device determines that information that the second user site requests to access the VPN service is stored.

With reference to the first aspect, the first to the eighth possible implementation manners of the first aspect, in the ninth possible implementation manner of the first aspect,

After receiving the online request of the first user station, the first edge device sends the first access request to the network device.

In a second aspect, the present invention provides a network device, including:

a receiving unit, configured to receive a first access request sent by the first edge device, where the first access request is used to request that the first user station connected to the first edge device access the virtual private network VPN service;

a processing unit, configured to: when the receiving unit receives the first access request, determine that a second user station requests access to the VPN service, and configure the first edge device and the second user a second edge device connected to the site to access the VPN service by the first user site and the second user site.

In a first possible implementation manner of the second aspect, when the first edge device and the second edge device connected to the second user site are configured, the first user site and the second device are configured When the user site accesses the VPN service, the processing unit is specifically configured to deploy a first VPN tunnel from the first edge device to the second edge device, and deploy the second edge device to the a second VPN tunnel of the first edge device, the head end of the first VPN tunnel is associated with the first port, and the tail end of the first VPN tunnel is associated with the second port, the second VPN tunnel The head end is associated with the second port, the tail end of the second VPN tunnel is associated with the first port, and the first port is connected to the first user station on the first edge device. a port, the second port being a port on the second edge device that is connected to the second user site.

With reference to the first possible implementation of the second aspect, in a second possible implementation manner of the second aspect, the receiving unit is further configured to receive a second access request sent by the third edge device, The second access request is used to request that the third user station connected to the third edge device access the VPN service;

The processing unit is further configured to: when the receiving unit receives the second access request, determine that the first user site and the second user site access the VPN service, and deploy the Deploying a first edge device to a third VPN tunnel of the third edge device, deploying a fourth VPN tunnel from the third edge device to the first edge device, deploying from the second edge device to the a fifth VPN tunnel of the third edge device, and a sixth VPN tunnel from the third edge device to the second edge device;

The head end of the third VPN tunnel is associated with the first port, the tail end of the third VPN tunnel is associated with the third port, and the head end of the fourth VPN tunnel is associated with the third port. The trailing end of the fourth VPN tunnel is associated with the first port, the head end of the fifth VPN tunnel is associated with the second port, and the tail end of the fifth VPN tunnel is associated with the third port. The head end of the sixth VPN tunnel is associated with the third port, the tail end of the sixth VPN tunnel is associated with the second port, and the third port is the third edge device and the The port to which the third user site is connected.

In conjunction with the first or second possible implementation of the second aspect, in a third possible implementation of the second aspect, the method further includes: a sending unit;

The processing unit is further configured to allocate a VPN tunnel identifier for the VPN service;

The processing unit when deploying a first VPN tunnel from the first edge device to the second edge device and deploying a second VPN tunnel from the second edge device to the first edge device Specifically, the sending, by the sending unit, sending the first configuration parameter to the first edge device, to And sending, by the sending unit, the second configuration parameter to the second edge device;

The first configuration parameter includes: the VPN tunnel identifier, the port identifier of the first port, and the device identifier of the second edge device; the second configuration parameter includes: the VPN tunnel identifier, the a port identifier of the second port, and a device identifier of the first edge device.

In conjunction with the first or second possible implementation of the second aspect, in a fourth possible implementation of the second aspect, the method further includes: a sending unit;

The processing unit when deploying a first VPN tunnel from the first edge device to the second edge device and deploying a second VPN tunnel from the second edge device to the first edge device Specifically, the request for deploying the first VPN tunnel and the second VPN tunnel is sent to the controller by using the sending unit, where the request for deploying the first VPN tunnel and the second VPN tunnel includes The port identifier of the first port, the port identifier of the second port, the device identifier of the first edge device, and the device identifier of the second edge device.

With the first to fourth possible implementation manners of the second aspect, in a fifth possible implementation manner of the second aspect, the receiving unit is further configured to receive, by the first edge device, a first exit request or a second exit request sent by the second edge device, the first exit request is used to request to exit the VPN service from the first user site, and the second exit request is used to request Exiting the second user site from the VPN service;

The processing unit is further configured to: when the receiving unit receives the first exit request or the second exit request, cancel the deployed first VPN tunnel and the second VPN tunnel.

With reference to the fifth possible implementation of the second aspect, in a sixth possible implementation manner of the second aspect, the method further includes: a sending unit;

The processing unit is further configured to acquire related information used to indicate deployment time of the first VPN tunnel and the second VPN tunnel;

The sending unit is configured to send the related information to a charging device.

With reference to the first to sixth possible implementation manners of the second aspect, in a seventh possible implementation manner of the second aspect, the first access request further includes the first user site request Accessing the account of the VPN service;

The processing unit is further configured to acquire a quality of service QoS corresponding to the account;

When the first VPN tunnel from the first edge device to the second edge device is deployed, the processing unit is specifically configured to deploy from the first edge device to the QoS based on the QoS corresponding to the account The first VPN tunnel of the second edge device.

With reference to the second aspect, the first to the seventh possible implementation manners of the second aspect, in the eighth possible implementation manner of the second aspect, the processing unit is further configured to: when the receiving And receiving, by the unit, the information that the first user station requests to access the VPN service when receiving the first access request;

When it is determined that the second user site requests to access the VPN service, the processing unit is specifically configured to determine that the information that the second user site requests to access the VPN service is stored.

With reference to the second aspect, the first to the eighth possible implementation manners of the second aspect, in the ninth possible implementation manner of the second aspect, the first edge device is configured to receive the first After the online request of the user site, the device that sends the first access request to the network device is sent.

According to the foregoing technical solution, when the network device in the present invention receives the first access request for requesting the first user site to access the VPN service, the first user site does not directly access the VPN service. Determining that a second user site different from the first user site requests to access the VPN service, that is, the first user site can transmit data with the second user site after accessing the VPN service. Configuring a first edge device connected to the first user site and a second edge device connected to the second user site to access the first user site and the second user site VPN business. It can be seen that, when it is determined that the first user station can access the VPN service and can transmit data with the second user station, the first user site and the second user site are access to the VPN. The service, that is, the first user site accesses the VPN service on demand, so as to avoid occupying the resources of the first edge device as much as possible but the first user site cannot transmit data. Therefore, resource waste is reduced.

DRAWINGS

1 is a schematic flow chart of an embodiment of a method provided by the present invention;

2 is a network topology used in an embodiment of the present invention;

3 is a schematic flow chart of another method embodiment provided by the present invention;

4 is another network topology used in an embodiment of the present invention;

Figure 5 is a specific path of the first VPN tunnel acquired by the controller;

FIG. 6 is a schematic structural diagram of an apparatus embodiment of a network device according to the present invention;

FIG. 7 is a schematic structural diagram of another apparatus embodiment of a network device according to the present invention; FIG.

FIG. 8 is a schematic structural diagram of another apparatus embodiment of a network device according to the present invention.

detailed description

In order to enable data transmission between users' sites using VPN, the user site needs to be first connected to the VPN service. The user site is a user-side device. Each user site is connected to the edge device of the carrier through a physical connection. The edge devices of the carrier can transmit data through the backbone network.

The current practice of connecting a user site to a VPN service is that the operator and the user manually negotiate all the user sites that need to access the VPN service. When all the user sites are determined, the edge of each of the user sites is separately connected. The device is manually configured to access each of the user sites to the VPN service.

However, the inventor has found that the user equipment needs to configure the edge device connected to the user site when accessing the VPN service, which will inevitably occupy the resources of the edge device. Accessing the VPN service means that even if the user station accesses the VPN service, the data cannot be transmitted, and the operator still accesses the user site to the VPN service. As a result, even if the resources of the edge device connected to the user site are occupied, the user site cannot transmit data, thereby causing waste of resources. The following is illustrated by an example. It is assumed that there are three user sites: user site 01, user site 02, and user site 03. If user site 02 and user site 03 are offline or do not have access to VPN services, then even if user site 01 is connected The user site 01 cannot transmit data to the user site 02 and the user site 03, but the edge device connected to the user site 01 is still configured to access the VPN service. This has resulted in a waste of resources.

In the embodiment of the present invention, a VPN service access method and a network device are provided to implement a user site to access a VPN service on demand, thereby reducing resource waste.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The terms "first" and "second" in the specification and claims of the present invention and the above drawings, "Third", "fourth", etc. are used to distinguish similar objects, and are not necessarily used to describe a particular order or order. It is to be understood that the data so used may be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than what is illustrated or described herein. In addition, the terms "comprises" and "comprises" and "comprises" and "the" and "the" are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series or unit is not necessarily limited to those that are clearly listed Or units, but may include other or units that are not explicitly listed or inherent to such processes, methods, products, or devices.

Referring to FIG. 1, an embodiment of the present invention provides an embodiment of a method for accessing a VPN service.

In order to better understand the technical solution of the embodiment of the present invention, an optional network topology used in this embodiment is described below through FIG. It should be noted that FIG. 2 is only an exemplary description, and the specific structure thereof does not limit the embodiment of the present invention.

As shown in FIG. 2, the first edge device and the second edge device belong to an edge device of the operator, and are connected through a backbone network. The first edge device is connected to the first user site by means of a physical connection. In the art, the first user site may also be referred to as being attached to the first edge device. The first port connected to the first user site on the first edge device may be referred to as an access port of the first user site. Similarly, the second edge device is connected to the second user site, and the second port on the second edge device connected to the second user site may be referred to as an access port of the second user site. The VPN data of the first user site and the second user site need to be transmitted by using the first edge device, the backbone network, and the second edge device. It should be noted that in FIG. 2 and FIG. 4 of the present invention, the solid line indicates the physical connection, and the broken line indicates the logical relationship, that is, the interaction between the devices is the control information.

The method of this embodiment includes:

The network device receives the first access request sent by the first edge device, where the first access request is used to request that the first user station connected to the first edge device access the VPN service. .

In the embodiment of the present invention, when the first edge device determines that the first user site needs to access the VPN service, for example, after receiving an online request of the first user site, The network device sends the first access request. The embodiment may further include that the first edge device sends the online request to the network device after receiving the online request of the first user station. First access request.

In a specific implementation, the user may apply for the VPN service in advance, for example, the user may apply for the VPN service on the website of the operator. The VPN service may correspond to one registered account, or may correspond to multiple registered accounts. The network device saves the correspondence between the opened VPN service and the registered account. After the VPN service is enabled, the user may send an online request including the registered account to the first edge device, and the first edge device determines, according to the registered account in the online request, that the first user site needs to be connected. Entering the VPN service to send the first access request to the network device. The first edge device may further send the registration account to the authentication device for authentication, and then send the first access request after the authentication is passed.

In the embodiment of the present invention, the first access request may include an identifier of the first user site and an identifier of the VPN service. The identifier of the first user site may specifically be a port identifier of the first port. The identifier of the VPN service may be specifically allocated by the network device. The first access request may be included in the billing CC information to the network device.

102: The network device determines that the second user site requests to access the VPN service. The second user site is a user site different from the first user site.

In the embodiment of the present invention, after the network device receives the first access request, the first user site is not directly connected to the VPN service, but is further determined whether there is a first The second user site that is different from the user site accesses the VPN service, and if yes, the network device determines that the second user site requests to access the VPN service.

If the network device determines that the second user site requests access to the VPN service, indicating that both the first user site and the second user site request to access the VPN service, After the first user site and the second user site access the VPN service, the first user site can transmit data with the second user site.

It should be noted that, in the embodiment of the present invention, the second user site refers to any user site different from the first user site. That is, when the network device determines that any user station different from the first user site accesses the VPN service, the user site is used as the second user site.

103: The network device configures the first edge device and the second edge device connected to the second user site to access the first user site and the second user site to the VPN business.

In the embodiment of the present invention, when the network device determines that the second user site different from the first user site requests to access the VPN service, the first user site access can be further determined. The VPN service can then transmit data with the second user site, so the first edge device and the second edge device are configured to access the first user site and the second user site. Said VPN business.

Optionally, the embodiment further includes: if the network device determines that the user site other than the first user site accesses the VPN service, the first user site accesses the VPN If the data cannot be transmitted after the service, the process may not be performed 103. Instead, the process of this embodiment may be directly ended. After the preset period, it may be determined whether there is a second one different from the first user site. The user site accesses the VPN service.

According to the foregoing technical solution, when the network device in the embodiment of the present invention receives the first access request for requesting the first user station to access the VPN service, the network device does not directly A user site accesses the VPN service, but determines that the second user site that is different from the first user site requests to access the VPN service, that is, the first user site accesses the When the VPN service is capable of transmitting data with the second user site, configuring the first edge device connected to the first user site and the second edge device connected to the second user site to The first user site and the second user site access the VPN service. It can be seen that, when it is determined that the first user station can access the VPN service and can transmit data with the second user station, the first user site and the second user site are access to the VPN. The service, that is, the first user site accesses the VPN service on demand, so as to avoid occupying the resources of the first edge device as much as possible but the first user site cannot transmit data. Therefore, resource waste is reduced.

In the embodiment of the present invention, the network device may be a device with a collaborative management function, such as a collaboration device, an orchestrator device, or a network management device. The first edge device and the second edge device may be Broadband Network Gateway (BNG). The first user site and the second user site may be user premises equipment (referred to as: CPE).

In the embodiment of the present invention, the network device receives the first access request sent by the first edge device, and may further store information that the first user site requests to access the VPN service, for example, Storing a correspondence between the VPN service and a port identifier of the first port, when again After receiving the access request sent by the other edge device, the information about the first user site accessing the VPN service may be determined according to the stored information. Therefore, the network device in the 102 determines that the second user station requests to access the VPN service, and the method includes: determining, by the network device, that the second user site requests to access the VPN service. .

In the embodiment of the present invention, when the network device receives the first access request, and determines that the second user site requests access to the VPN service, configuring the first edge device and the first The two edge devices are configured to access the VPN service by using the first user site and the second user site. The network device may have two configurations when the first edge device and the second edge device are configured. The first configuration manner is that the first user site and the second user site are independent. Accessing the VPN service, that is, each user site accessing the VPN service does not know other user equipments that access the VPN service. The second configuration mode is to connect the first user site and the second user site to the VPN service by deploying a VPN tunnel between the first user site and the second user site. The two configuration methods are described below.

The first configuration manner: the network device may separately configure the first edge device and the second edge device, so that the first user site and the second user site independently access the VPN service.

For example, the network device sends a configuration parameter to the first edge device, where the configuration parameter includes only configuration parameters for accessing the first user site to the VPN service, for example, a port identifier of the first port. Without including the configuration parameters associated with the second user site. The port identifier of the first port may be obtained from the first access request. In some scenarios, the network device may further send, to the first edge device, a first route target parameter (English: Route Target, referred to as RT) allocated by the network device to the first user site. A routing specifier parameter (English: Route Ditinguiher, referred to as: RD). Similarly, the configuration parameter sent by the network device to the second edge device only includes configuration parameters for accessing the VPN service by the second user site, for example, a port identifier of the second port, and Configuration parameters related to the first user site are not included. The port identifier of the second port may be obtained from an access request for requesting the second user site to access the VPN service. In some scenarios, the network device may further send, to the second edge device, a second RT and a second RD that are allocated by the network device to the second user site. The first edge device and the second edge device respectively respectively use the first edge device and the second edge device according to configuration parameters sent by the network device Independent access to the VPN service.

The second configuration mode is: in some scenarios, for example, when the user applies for the VPN service, and the VPN service is a point-to-point service type, the second configuration mode may be adopted, that is, The VPN service is deployed in a manner that a VPN tunnel is deployed between the first edge device and the second edge device. This will be specifically described below by way of an embodiment.

Referring to FIG. 3, an embodiment of the present invention provides another method embodiment of a method for accessing a VPN service. Different from other embodiments, this embodiment focuses on accessing the VPN service by deploying a VPN tunnel between the first edge device and the second edge device.

The method of the present embodiment includes 301 to 303, wherein 301 and 302 are similar to 101 and 102 of the embodiment shown in FIG. 1, so the description is relatively simple, and the relevant embodiment is shown in FIG. This embodiment focuses on 303.

301: The network device receives a first access request sent by the first edge device, where the first access request is used to request that the first user station that is connected to the first edge device access the VPN business.

302: The network device determines that the second user site requests access to the VPN service, and the second user site is a user site different from the first user site.

303: The network device deploys a first VPN tunnel from the first edge device to the second edge device, and deploys a second VPN tunnel from the second edge device to the first edge device.

The head end of the first VPN tunnel is associated with the first port, the tail end of the first VPN tunnel is associated with the second port, and the head end of the second VPN tunnel is opposite to the second A port association, the tail end of the second VPN tunnel being associated with the first port. The first port is a port that is connected to the first user site on the first edge device, that is, an access port of the first user site, and the second port is on the second edge device. The port to which the second user site is connected, that is, the access port of the second user site.

An implementation manner in which a head end or a tail end of a VPN tunnel is associated with a port in the embodiment of the present invention is described below. The first end of the first VPN tunnel is associated with the first port, and the mapping relationship between the first port and the first VPN tunnel is stored on the first edge device, so that the The first edge device transmits the data received from the first port through the first VPN tunnel according to the mapping relationship. The trailing end of the first VPN tunnel is associated with the second port, and may be specifically configured to store the second port and the first on the second edge device. The mapping relationship of the VPN tunnel, so that the second edge device outputs the data transmitted by the first VPN tunnel to the second port according to the mapping relationship.

Similarly, the head end of the second VPN tunnel is associated with the second port, and the end of the second VPN tunnel is associated with the first port, which may be specifically implemented in the foregoing manner, and details are not described herein.

In the embodiment of the present invention, after receiving the first access request, the network device does not directly access the first user station to the VPN service, but determines whether there is the second user. The site requests access to the VPN service, and if yes, the network device actually acquires two user sites that access the VPN service, and the network device may deploy the first VPN tunnel and the first The two VPN tunnels access the two user sites to the VPN service.

It can be seen that, in this embodiment, the implementation manner of the second configuration manner is described, that is, the first VPN tunnel and the second VPN tunnel are deployed between the first edge device and the second edge device. And the first user site and the second user site are connected to the VPN service. In fact, the first VPN tunnel and the second VPN tunnel are point-to-point VPN tunnels between the first user site and the second user site, and thus are compared to the first The configuration mode is that the first user site and the second user site are independently connected to the VPN service, and the second configuration mode does not need to automatically discover the site, so there is no need to run a complicated discovery protocol. Edge devices have lower equipment requirements and lower error rates.

In this embodiment, after the first VPN tunnel and the second VPN tunnel are deployed between the first edge device and the second edge device, if other user sites request to access the VPN For the service, the edge device connected to the other user site may be deployed with the first edge device and the second edge device respectively. The specific implementation manner is that the network device receives a second access request sent by the third edge device, where the second access request is used to request that the third user station connected to the third edge device access the VPN The network device determines that the first user site and the second user site access the VPN service; and the network device deploys the first edge device to the third edge device a third VPN tunnel, and a fourth VPN tunnel from the third edge device to the first edge device, the head end of the third VPN tunnel being associated with the first port, the third VPN tunnel The trailing end is associated with the third port, the head end of the fourth VPN tunnel is associated with the third port, the tail end of the fourth VPN tunnel is associated with the first port, and the third port is the a port connected to the third user site on the third edge device; the network device deploying a fifth VPN from the second edge device to the third edge device a tunnel, and a sixth VPN tunnel from the third edge device to the second edge device, a head end of the fifth VPN tunnel is associated with the second port, and a tail end of the fifth VPN tunnel Associated with the third port, a head end of the sixth VPN tunnel is associated with the third port, and a tail end of the sixth VPN tunnel is associated with the second port. The specific manner of the port is associated with the head end or the tail end of the tunnel. For details, refer to that the head end of the first VPN tunnel is associated with the first port, and the tail end of the second VPN tunnel is The specific representation of the second port association. I won't go into details here.

It should be noted that the network device may be configured by directly configuring the first edge device and the second edge device to implement the first VPN tunnel and the second VPN tunnel, for example, to the first The edge device and the second edge device send configuration parameters. The network device may further configure the first edge device and the second edge device indirectly, for example, by sending a request to other devices, and deploying the first VPN tunnel and the second VPN tunnel by other devices. The following are explained separately.

First explain the way of direct configuration. The embodiment may further include: the network device assigning a VPN tunnel identifier to the VPN service. 303 of the present embodiment includes 3031 and 3032. The VPN tunnel identifier is used to uniquely represent the VPN tunnel. The VPN tunnel refers to a VPN tunnel for carrying VPN services, for example, an MPLS LSP tunnel, an MPLS TE tunnel, an L2TP tunnel, a GRE tunnel, an IPSEC tunnel, and the like, which are not limited in this embodiment of the present invention.

3031: The network device sends a first configuration parameter to the first edge device, where the first configuration parameter includes: the VPN tunnel identifier, a port identifier of the first port, and the second edge device Equipment Identity. The device identifier of the second edge device may specifically be an IP address of the second edge device.

3032: The network device sends a second configuration parameter to the second edge device, where the second configuration parameter includes: the VPN tunnel identifier, a port identifier of the second port, and the first edge device Equipment Identity. The device identifier of the first edge device may specifically be an IP address of the first edge device.

It can be seen that the first configuration parameter sent to the first edge device includes a configuration parameter related to the second user site: a device identifier of the second edge device, and the second edge device is The second configuration parameter that is sent includes a configuration parameter related to the first user site: a device identifier of the first edge device. Wherein the first edge device and the second side The edge device deploys the first VPN tunnel and the second VPN tunnel according to the first configuration parameter and the second configuration parameter, and may be configured according to any one of the current VPN tunnels. Limited. In some scenarios, the network device may further send, to the first edge device, a first RT and a first RD allocated for the first user site, and send the first RD to the second edge device. The second RT and the second RD assigned by the two user sites.

The manner of indirect configuration is described below, specifically by deploying the first VPN tunnel and the second VPN tunnel by sending a request to other devices. Referring to FIG. 4, the 303 of the embodiment may include: the network device sending, to the controller 401, the first VPN tunnel and the deployment between the first edge device and the second edge device. The request for the first VPN tunnel and the second VPN tunnel includes the port identifier of the first port, the port identifier of the second port, and the first request The device identifier of the edge device and the device identifier of the second edge device. The request for deploying the first VPN tunnel and the second VPN tunnel may further include an identifier of the VPN service.

After receiving the request, the controller 401 deploys the first VPN tunnel and the second VPN tunnel between the first edge device and the second edge device according to the request. The controller 401 may obtain the first VPN according to the device identifier of the first edge device and the device identifier of the second edge device when the first VPN tunnel and the second VPN tunnel are deployed. The specific path of the tunnel and the second VPN tunnel, that is, the path device of the first VPN tunnel and the second VPN tunnel. And generating, according to the path, the port identifier of the first port, and the port identifier of the second port, a forwarding entry for each path device, so that each of the path devices is configured according to the The forwarding entry transmits data. The controller 401 can be an SDN controller.

The forwarding entry may include a label allocated by the controller 401 and an output port. The manner in which the first VPN tunnel is deployed is illustrated by a specific example. As shown in FIG. 5, the path device of the first VPN tunnel acquired by the controller 401 includes: BNG1, RouterRouter1, Router2, and BNG2. The BNG1 and the BNG2 are the first edge device and the second edge device, respectively.

The request sent by the network device to the controller 401 is:

Port1/BNG1-->port2/BNG2

The forwarding entry sent by the controller 401 to the BNG1 is:

Port1-->port3,with Label 100

The forwarding entry sent by the controller 401 to the Router1 is:

Port4with label 100-->port5with label 200

The forwarding entry sent by the controller 401 to the Router 2 is:

Port6with label 200-->port7with labe 100

The forwarding entry sent by the controller 401 to the BNG2 is:

Port8with label 100-->port2

The port 1 is the first port, the port 2 is the second port, the port 3 and port 4 are ports connected to the BNG 1 and the router 1, and the port 5 and port 6 are the router 1 and the port 1 Ports connected to Router 2, where port 7 and port 8 are ports connected to Router 2 and the BNG 2.

It can be seen that, by using the controller 401, the forwarding entry is delivered to each of the path devices, so that the first VPN tunnel is deployed between the first edge device and the second edge device. The route device includes the first edge device and the second edge device. The deployment manner of the second VPN tunnel is similar to that of the first VPN tunnel, and details are not described herein again.

Optionally, in this embodiment, the VPN service may correspond to one or more accounts, and each account may correspond to different QoS. Therefore, when the first VPN tunnel is deployed, the user may also use the VPN tunnel. Qos corresponding to the account number. Specifically, the first access request further includes an account that the first user station requests to access the VPN service; the embodiment may further include: the network device acquiring a QoS corresponding to the account; the network The device deploying the first VPN tunnel from the first edge device to the second edge device includes: the network device deploying from the first edge device to the second edge device based on QoS corresponding to the account The first VPN tunnel. The account of the second user site requesting access to the VPN service may be further obtained, and the second VPN tunnel is deployed according to the QoS corresponding to the account. The first VPN tunnel and the second VPN tunnel that are ultimately deployed may have different QoS.

Further, in this embodiment, when the first VPN tunnel and the second VPN tunnel are deployed, bandwidth may be reserved for the first VPN tunnel and the second VPN tunnel, and When the first user site or the second user site needs to exit the VPN service, for example, when the first user site or the second user site requests offline, the first user site may further be revoked. a VPN tunnel and the second VPN tunnel to release bandwidth reserved for the first VPN tunnel and the second VPN tunnel. In a specific implementation, the network device receives a first exit request sent by the first edge device or a second exit request sent by the second edge device, where the first exit request is used to request the first user The site exits the VPN service, and the second exit request is used to request that the second user site exit the VPN service; the network device revokes deployment between the first edge device and the second edge device The first VPN tunnel and the second VPN tunnel.

Currently, when charging a VPN service, since the VPN service cannot be accessed on demand, the QoS is generally performed according to the QoS of the opened VPN service. Further, in this embodiment, since the first VPN tunnel and the second VPN tunnel are deployed and revoked on demand, the first VPN tunnel and the second VPN tunnel may be The deployment time, that is, the actual time of accessing the VPN service of the first user site for charging. In a specific implementation, the embodiment further includes: the network device acquiring related information for indicating a deployment time of the first VPN tunnel and the second VPN tunnel; and the network device sending the related information to the The charging device may obtain the deployment time of the first VPN tunnel and the second VPN tunnel according to the related information, so as to perform charging according to the deployment time. The related information may be the deployment time of the first VPN tunnel and the second VPN tunnel, or may be the time and the revocation of the first VPN tunnel and the second VPN tunnel. At the time of the first VPN tunnel and the second VPN tunnel, the charging device calculates the deployment time of the first VPN tunnel and the second VPN tunnel according to the two moments.

The embodiment of the access method of the VPN service in the embodiment of the present invention is described above. The device embodiment of the network device in the embodiment of the present invention will be described below from the perspective of the modular functional entity.

Referring to FIG. 6, an embodiment of the present invention provides an apparatus embodiment of a network device 600.

For a better understanding of the technical solution of the embodiment of the present invention, an optional network topology used by the network device of this embodiment is described below with reference to FIG. It should be noted that FIG. 2 is only an exemplary description, and the specific structure thereof does not limit the embodiment of the present invention. As shown in FIG. 2, the network device is connected to the first edge device and the second edge device, and the first edge device and the second edge device belong to an edge device of the operator, and are connected through a backbone network. The first edge device is connected to the first user site by means of a physical connection. The second edge device is connected to the second user site by being physically connected.

The network device 600 of this embodiment includes: a receiving unit 601 and a processing unit 602.

The receiving unit 601 is configured to receive a first access request sent by the first edge device, where the first access request is used to request to access the first user station that is connected to the first edge device. VPN business.

In the embodiment of the present invention, when the first edge device determines that the first user site needs to access the VPN service, for example, after receiving an online request of the first user site, The network device 600 sends the first access request. The first edge device may be a device that sends the first access request to the network device 600 after receiving an online request of the first user site.

In a specific implementation, the user may apply for the VPN service in advance, for example, the user may apply for the VPN service on the website of the operator. The VPN service may correspond to one registered account, or may correspond to multiple registered accounts. The network device 600 saves the correspondence between the opened VPN service and the registered account. After the VPN service is enabled, the user may send an online request including the registered account to the first edge device, and the first edge device determines, according to the registered account in the online request, that the first user site needs to be connected. The VPN service is entered, thereby transmitting the first access request to the network device 600. The first edge device may further send the registration account to the authentication device for authentication, and then send the first access request after the authentication is passed.

In the embodiment of the present invention, the first access request may include an identifier of the first user site and an identifier of the VPN service. The identifier of the first user site may specifically be a port identifier of the first port. The identifier of the VPN service may be specifically allocated by the network device 600.

The processing unit 602 is configured to determine, when the receiving unit 601 receives the first access request, that the second user station requests to access the VPN service. The second user site is a user site different from the first user site.

In the embodiment of the present invention, after the receiving unit 601 receives the first access request, the processing unit 602 does not directly access the first user station to the VPN service, but further determines whether The second user site that is different from the first user site accesses the VPN service, and if yes, the processing unit 602 determines that the second user site requests to access the VPN service.

If the processing unit 602 determines that the second user site requests to access the VPN service, The first user site and the second user site are both requested to access the VPN service, and after the first user site and the second user site are connected to the VPN service, the The first user site is capable of transmitting data with the second user site.

It should be noted that, in the embodiment of the present invention, the second user site refers to any user site different from the first user site. That is, the processing unit 602 is specifically configured to determine that any user site different from the first user site accesses the VPN service, and use any one of the user sites as the second user site.

The processing unit 602 is further configured to: configure the first edge device and the second edge connected to the second user site when determining that the second user site requests access to the VPN service The device is configured to access the VPN service by using the first user site and the second user site.

In the embodiment of the present invention, when the processing unit 602 determines that the second user site different from the first user site requests to access the VPN service, the first user site can be further determined. After the VPN service is entered, the data can be transmitted with the second user site, so the first edge device and the second edge device are configured to access the first user site and the second user site. The VPN service.

The processing unit 602 is further configured to: if it is determined that the user site other than the first user site accesses the VPN service, the first user site cannot transmit after accessing the VPN service. In the case of data, the first user site is not connected to the VPN service, but may end the work, or may be re-determined after the preset period whether there is a second second different from the first user site. The user site accesses the VPN service.

According to the foregoing technical solution, when the receiving unit 601 in the embodiment of the present invention receives the first access request for requesting the first user station to access the VPN service, the processing unit 602 Not directly accessing the first user site to the VPN service, but determining that the second user site different from the first user site requests access to the VPN service, that is, the first Configuring the first edge device connected to the first user site and the first connection with the second user site when the user site can access the VPN service and can transmit data with the second user site The two edge devices are configured to access the VPN service by using the first user site and the second user site. It can be seen that, when it is determined that the first user station can access the VPN service and can transmit data with the second user station, the first user site and the second user site are access to the VPN. The service, that is, the first user site is accessed to access the VPN on demand. The service, so as to avoid the situation that the resources of the first edge device are occupied but the first user site cannot transmit data, thereby reducing resource waste.

In the embodiment of the present invention, the network device 600 may be a device with a collaborative management function, such as a collaboration device, an orchestration device, and a network management device. The first edge device and the second edge device may be BNGs, and the first user site and the second user site may be CPEs.

In the embodiment of the present invention, when the receiving unit 601 receives the first access request sent by the first edge device, the processing unit 602 may be further configured to store the first user site request The information about the VPN service, for example, the corresponding relationship between the VPN service and the port identifier of the first port is specifically stored. After the receiving unit 601 receives the access request sent by another edge device again, the processing unit 602. Determine, according to the stored information, information that the first user station accesses the VPN service. Therefore, when it is determined that the second user site requests to access the VPN service, the processing unit 602 may be specifically configured to determine that the information that the second user site requests to access the VPN service is stored.

In the embodiment of the present invention, when the receiving unit 601 receives the first access request, and the processing unit 602 determines that the second user site requests access to the VPN service, the processing unit 602 And configuring the first edge device and the second edge device to access the VPN service by using the first user site and the second user site. The processing unit 602 may have two configurations when configuring the first edge device and the second edge device, where the first configuration manner is to use the first user site and the second user site. The user accesses the VPN service independently, that is, each user station accesses the VPN service and does not know other user equipments that access the VPN service. The second configuration mode is to connect the first user site and the second user site to the VPN service by deploying a VPN tunnel between the first user site and the second user site. The two configuration methods are described below.

The first configuration mode: the processing unit 602 can separately configure the first edge device and the second edge device, so that the first user site and the second user site independently access the VPN service. .

For example, the network device 600 may further include a sending unit, where the processing unit 602 sends a configuration parameter to the first edge device by using the sending unit, where the configuration parameter includes only for accessing the first user station. The configuration parameter of the VPN service, for example, the port identifier of the first port, does not include configuration parameters related to the second user site. Where the first port is The port identification can be obtained from the first access request. In some scenarios, the processing unit 602 may further send, by the sending unit, the first edge device, the first RT and the first RD that are allocated by the network device 600 to the first user site. Similarly, the configuration parameter sent by the processing unit 602 to the second edge device by using the sending unit includes only configuration parameters for accessing the second user station to the VPN service, for example, The port identification of the second port, without including the configuration parameters associated with the first user site. The port identifier of the second port may be obtained from an access request for requesting the second user site to access the VPN service. In some scenarios, the processing unit 602 may further send, by the sending unit, the second edge device, the second RT and the second RD that the network device 600 allocates to the second user site. The first edge device and the second edge device independently access the VPN service by the first edge device and the second edge device according to the configuration parameters sent by the network device 600.

The second configuration mode is: in some scenarios, for example, when the user requests the VPN service to set the VPN service as a point-to-point service type, the first edge device and the first A VPN tunnel is deployed between the two edge devices to access the VPN service. This will be specifically described below by way of an embodiment.

Referring to FIG. 7, an embodiment of the present invention provides another apparatus embodiment of the network device 700. Different from other embodiments, this embodiment focuses on accessing the VPN service by deploying a VPN tunnel between the first edge device and the second edge device.

The network device 700 of this embodiment includes: a receiving unit 701 and a processing unit 702.

The receiving unit 701 is configured to receive a first access request sent by the first edge device, where the first access request is used to request to access the first user station that is connected to the first edge device. The VPN service.

The processing unit 702 is configured to: when the receiving unit 701 receives the first access request, determine that the second user station requests to access the VPN service, where the second user site is A different user site of the first user site.

The functions of the receiving unit 701 and the processing unit 702 are similar to those of the receiving unit 601 and the processing unit 602 in the embodiment shown in FIG. 6, so the description is relatively simple. The embodiment shown in Figure 6.

The processing unit 702 is further configured to: when it is determined that the second user site requests to access the During the VPN service, a first VPN tunnel from the first edge device to the second edge device is deployed, and a second VPN tunnel from the second edge device to the first edge device is deployed.

An implementation manner in which a head end or a tail end of a VPN tunnel is associated with a port in the embodiment of the present invention is described below. The first end of the first VPN tunnel is associated with the first port, and the mapping relationship between the first port and the first VPN tunnel is stored on the first edge device, so that the The first edge device transmits the data received from the first port through the first VPN tunnel according to the mapping relationship. The trailing end of the first VPN tunnel is associated with the second port, and the mapping relationship between the second port and the first VPN tunnel is stored on the second edge device, so that the The second edge device outputs the data transmitted by the first VPN tunnel to the second port according to the mapping relationship.

In the embodiment of the present invention, after the receiving unit 701 receives the first access request, the processing unit 702 does not directly access the first user station to the VPN service, but determines whether The second user site requests access to the VPN service, and if so, the processing unit 702 actually acquires two user sites that access the VPN service, and the processing unit 702 can deploy the The two VPN sites access the VPN service in a manner of the first VPN tunnel and the second VPN tunnel.

It can be seen that, in this embodiment, the implementation manner of the second configuration manner is implemented, that is, the first VPN tunnel and the second VPN tunnel are deployed between the first edge device and the second edge device. The first user site and the second user site are connected to the VPN service. In fact, the first VPN tunnel and the second VPN tunnel are point-to-point VPN tunnels between the first user site and the second user site, and thus are compared to the first Configuration side The first user site and the second user site are independently connected to the VPN service, and the second configuration mode does not need to automatically discover the site, so there is no need to run a complicated discovery protocol, and the edge device is Equipment requirements are lower and the error rate is lower.

In this embodiment, after the first VPN tunnel and the second VPN tunnel are deployed between the first edge device and the second edge device, if other user sites request to access the VPN For the service, the edge device connected to the other user site may be deployed with the first edge device and the second edge device respectively. The receiving unit 701 is further configured to receive a second access request sent by the third edge device, where the second access request is used to request a third user site that connects the third edge device. Accessing the VPN service; the processing unit 702 is further configured to: when the receiving unit 701 receives the second access request, determine that the first user site and the second user site are connected Deploying the VPN service, deploying a third VPN tunnel from the first edge device to the third edge device, and deploying a fourth VPN tunnel from the third edge device to the first edge device, deploying a slave And a fifth VPN tunnel from the second edge device to the third edge device, and a sixth VPN tunnel from the third edge device to the second edge device. The head end of the third VPN tunnel is associated with the first port, the tail end of the third VPN tunnel is associated with the third port, and the head end of the fourth VPN tunnel is associated with the third port. The trailing end of the fourth VPN tunnel is associated with the first port, the head end of the fifth VPN tunnel is associated with the second port, and the tail end of the fifth VPN tunnel is associated with the third port. The head end of the sixth VPN tunnel is associated with the third port, and the tail end of the sixth VPN tunnel is associated with the second port. The specific manner of the port is associated with the head end or the tail end of the tunnel. For details, refer to that the head end of the first VPN tunnel is associated with the first port, and the tail end of the second VPN tunnel is The specific representation of the second port association. I won't go into details here.

It should be noted that the processing unit 702 may be configured to directly deploy the first edge device and the second edge device to implement the first VPN tunnel and the second VPN tunnel, for example, to the first edge. The device and the second edge device send configuration parameters. The processing unit 702 can also indirectly configure the first edge device and the second edge device, for example, deploying the first VPN tunnel and the second VPN tunnel by other devices by sending a request to other devices. The following are explained separately.

First explain the way of direct configuration. The network device 700 of this embodiment further includes a sending unit. The processing unit 702 is further configured to allocate a VPN tunnel identifier for the VPN service. The VPN tunnel identifier uniquely represents a VPN tunnel, and the VPN tunnel refers to the VPN service. VPN tunnel.

When the first VPN tunnel and the second VPN tunnel of the VPN service are deployed between the first edge device and the second edge device, the processing unit 702 is specifically configured to use the sending unit to The first edge device sends a first configuration parameter, and sends a second configuration parameter to the second edge device by using the sending unit; the first configuration parameter includes: the VPN tunnel identifier, the first port The port identifier, and the device identifier of the second edge device; the second configuration parameter includes: the VPN tunnel identifier, the port identifier of the second port, and the device identifier of the first edge device.

It can be seen that the first configuration parameter sent to the first edge device includes a configuration parameter related to the second user site: a device identifier of the second edge device, and the second edge device is The second configuration parameter that is sent includes a configuration parameter related to the first user site: a device identifier of the first edge device. The first edge device and the second edge device deploy the first VPN tunnel and the second VPN tunnel according to the first configuration parameter and the second configuration parameter, and may be according to any current VPN. The tunnel deployment mode is not limited in this embodiment of the present invention. In some scenarios, the processing unit 702 may be further configured to send, by using the sending unit, the first RT and the first RD allocated to the first user site to the first edge device, and to the first The two edge devices send the second RT and the second RD allocated for the second user site.

The manner of indirect configuration is described below, specifically by deploying the first VPN tunnel and the second VPN tunnel by sending a request to other devices. The network device 700 of this embodiment further includes a sending unit, when the first VPN tunnel and the second VPN tunnel of the VPN service are deployed between the first edge device and the second edge device, The processing unit 702 is specifically configured to send, by using the sending unit, a request for deploying the first VPN tunnel and the second VPN tunnel between the first edge device and the second edge device to a controller, where The request for deploying the first VPN tunnel and the second VPN tunnel includes a port identifier of the first port, a port identifier of the second port, a device identifier of the first edge device, and the The device identifier of the second edge device. The request for deploying the first VPN tunnel and the second VPN tunnel may further include: an identifier of the VPN service.

After receiving the request, the controller deploys the first VPN tunnel and the second VPN tunnel between the first edge device and the second edge device according to the request. The controller may obtain the first VPN according to the device identifier of the first edge device and the device identifier of the second edge device when the first VPN tunnel and the second VPN tunnel are deployed. The specific path of the tunnel and the second VPN tunnel, that is, the path device of the first VPN tunnel and the second VPN tunnel. And generating, according to the path, the port identifier of the first port, and the port identifier of the second port, a forwarding entry for each path device, so that each of the path devices is configured according to the The forwarding entry transmits data. The label and the output port allocated by the controller 401 may be included in the forwarding entry. The connection relationship between the controller and the network device 700 can be as shown in FIG. 4. The controller may specifically be an SDN controller.

Optionally, in this embodiment, the VPN service may correspond to one or more accounts, and each account may correspond to different QoS. Therefore, when the first VPN tunnel is deployed, the user may also use the VPN tunnel. Qos corresponding to the account number. Specifically, the first access request further includes an account that the first user station requests to access the VPN service; the processing unit 702 is further configured to acquire a QoS corresponding to the account; When the first edge device is connected to the first VPN tunnel of the second edge device, the processing unit 702 is specifically configured to deploy the first edge device to the second edge device based on the QoS corresponding to the account The first VPN tunnel. The processing unit 702 is further configured to obtain an account that the second user station requests to access the VPN service, and deploy the second VPN tunnel according to the QoS corresponding to the account. The first VPN tunnel and the second VPN tunnel that are ultimately deployed may have different QoS.

Further, in this embodiment, when the first VPN tunnel and the second VPN tunnel are deployed, bandwidth may be reserved for the first VPN tunnel and the second VPN tunnel, and When the first user site or the second user site needs to exit the VPN service, for example, when the first user site or the second user site requests offline, the first VPN tunnel and the office may be further revoked. The second VPN tunnel is configured to release bandwidth reserved for the first VPN tunnel and the second VPN tunnel. In a specific implementation, the receiving unit 701 is further configured to receive a first exit request sent by the first edge device or a second exit request sent by the second edge device, where the first exit request is used to request The first user site is logged out of the VPN service, and the second quit request is used to request the second user site to quit the VPN service. The processing unit 702 is further configured to receive, by the receiving unit 701, And canceling, by the first exit request or the second exit request, the first VPN tunnel and the second VPN tunnel deployed between the first edge device and the second edge device.

Currently, when charging a VPN service, since the VPN service cannot be accessed on demand, the QoS is generally performed according to the QoS of the opened VPN service. Further, in this embodiment, since the first VPN tunnel and the second VPN tunnel are deployed and revoked on demand, The charging is performed according to the deployment time of the first VPN tunnel and the second VPN tunnel, that is, the actual time of accessing the VPN service of the first user station. In a specific implementation, the network device 700 of this embodiment further includes: a sending unit; the processing unit 702 is further configured to: acquire, for indicating a deployment time of the first VPN tunnel and the second VPN tunnel, The sending unit is configured to send the related information to the charging device. The related information may be the deployment time of the first VPN tunnel and the second VPN tunnel, or may be the time and the revocation of the first VPN tunnel and the second VPN tunnel. At the time of the first VPN tunnel and the second VPN tunnel, the charging device calculates the deployment time of the first VPN tunnel and the second VPN tunnel according to the two moments.

The device embodiment of the network device in the embodiment of the present invention is described above from the perspective of a modular functional entity. The device embodiment of the network device in the embodiment of the present invention will be described below from the perspective of hardware processing.

Referring to FIG. 8, an embodiment of the present invention provides another apparatus embodiment of a network device. The network device 800 of this embodiment may be a microprocessor computer. For example, the network device 800 can be one of a portable device such as a general purpose computer, a custom machine, a mobile phone terminal, or a tablet. The network device 800 includes a processor 804, a memory 806, a communication interface 802, and a bus 808. The processor 804, the memory 806, and the communication interface 802 are connected by the bus 808 and complete communication with each other.

The bus 808 may be an Industry Standard Architecture (ISA) bus or a Peripheral Component (PCI) bus or an Extended Industry Standard Architecture (EISA). Bus, etc. The bus 808 can be divided into one or more of an address bus, a data bus, and a control bus. For ease of representation, only one thick line is shown in Figure 8, but it does not mean that there is only one bus or one type of bus.

The memory 806 is for storing executable program code, the program code including computer operating instructions. When the network device 800 executes the program code, the network device 800 can complete the embodiment shown in FIG. 1 or FIG. 3, and can also implement all the functions of the network device in the embodiment shown in FIG. 6 or FIG. 7. . The memory 806 can include a high speed RAM (Ramdom Access Memory) memory. Optionally, the memory 806 may further include a non-volatile memory. For example, the memory 806 can include a disk storage.

The processor 804 may be a central processing unit (CPU), or the processor 804 may be an application specific integrated circuit (ASIC), or the processor 804 may Is one or more integrated circuits that are configured to implement embodiments of the present invention.

The communication interface 802 is configured to perform the first access request sent by the first edge device in the embodiment shown in FIG. 1 and FIG. 3, where the first access request is used to request the first edge The first user station connected to the device accesses the VPN service.

The processor 804 is configured to read an instruction stored in the memory 806, so as to perform, in the embodiment shown in FIG. 1 and FIG. 3, that the second user site requests to access the VPN service, the second The user site is a user site different from the first user site, and the first edge device and a second edge device connected to the second user site are configured to use the first user site and the second The user site accesses the VPN service.

It should be noted that each functional unit of the network device provided by the present invention may be a specific implementation based on the method of the embodiment shown in FIG. 1 or FIG. 3 and the function of the apparatus shown in FIG. 6 or FIG. The definitions and descriptions of the terms are consistent with the embodiments shown in FIGS. 1, 3, 6, and 7, and are not described herein again.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the embodiments are modified, or some of the technical features are replaced by equivalents; and the modifications or substitutions do not deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

A method for accessing a VPN service of a virtual private network, comprising:

Receiving, by the network device, a first access request sent by the first edge device, where the first access request is used to request that the first user station connected to the first edge device access the VPN service;

Determining, by the network device, that the second user station requests to access the VPN service;

The network device configures the first edge device and a second edge device connected to the second user site to access the VPN service by the first user site and the second user site.
The method of claim 1, wherein the network device configures the first edge device and a second edge device connected to the second user site to place the first user site and the The second user site accesses the VPN service, including:

The network device deploys a first VPN tunnel from the first edge device to the second edge device, and deploys a second VPN tunnel from the second edge device to the first edge device, where A head end of a VPN tunnel is associated with the first port, a tail end of the first VPN tunnel is associated with the second port, and a head end of the second VPN tunnel is associated with the second port, The second port of the second VPN tunnel is associated with the first port, the first port is a port connected to the first user site on the first edge device, and the second port is the second edge The port on the device that is connected to the second user site.
The method of claim 2, further comprising:

Receiving, by the network device, a second access request sent by the third edge device, where the second access request is used to request that the third user station connected to the third edge device access the VPN service;

Determining, by the network device, that the first user site and the second user site access the VPN service;

The network device deploys a third VPN tunnel from the first edge device to the third edge device, and deploys a fourth VPN tunnel from the third edge device to the first edge device, the first The head end of the third VPN tunnel is associated with the first port, the tail end of the third VPN tunnel is associated with the third port, and the head end of the fourth VPN tunnel is associated with the third port, the fourth The trailing end of the VPN tunnel is associated with the first port, and the third port is a port connected to the third user station on the third edge device;

The network device deploys a fifth VPN tunnel from the second edge device to the third edge device, and deploys a sixth VPN tunnel from the third edge device to the second edge device, The head end of the fifth VPN tunnel is associated with the second port, the tail end of the fifth VPN tunnel is associated with the third port, and the head end of the sixth VPN tunnel is associated with the third port. The tail end of the sixth VPN tunnel is associated with the second port.
The method according to claim 2 or 3, wherein the method further comprises:

The network device allocates a VPN tunnel identifier to the VPN service;

The network device deploys a first VPN tunnel from the first edge device to the second edge device, and deploys a second VPN tunnel from the second edge device to the first edge device, including:

The network device sends a first configuration parameter to the first edge device, where the first configuration parameter includes: the VPN tunnel identifier, the port identifier of the first port, and the device identifier of the second edge device ;

The network device sends a second configuration parameter to the second edge device, where the second configuration parameter includes: the VPN tunnel identifier, the port identifier of the second port, and the device identifier of the first edge device .
The method according to claim 2 or 3, wherein the network device deploys a first VPN tunnel from the first edge device to the second edge device, and deploys from the second edge device to The second VPN tunnel of the first edge device includes:

The network device sends a request for deploying the first VPN tunnel and the second VPN tunnel to a controller, where the request for deploying the first VPN tunnel and the second VPN tunnel includes the first port The port identifier, the port identifier of the second port, the device identifier of the first edge device, and the device identifier of the second edge device.
The method according to any one of claims 2 to 5, further comprising:

Receiving, by the network device, a first exit request sent by the first edge device or a second exit request sent by the second edge device, where the first exit request is used to request to withdraw the first user site from the a VPN service, where the second exit request is used to request that the second user site exit the VPN service;

The network device revokes the first VPN tunnel and the second VPN tunnel.
The method of claim 6 further comprising:

Obtaining, by the network device, related information used to indicate deployment time of the first VPN tunnel and the second VPN tunnel;

The network device sends the related information to the charging device.
The method according to any one of claims 2 to 7, wherein the first access request further comprises an account that the first user station requests to access the VPN service;

The method further includes:

Obtaining, by the network device, a quality of service QoS corresponding to the account;

The network device deploying the first VPN tunnel from the first edge device to the second edge device, including:

The network device deploys the first VPN tunnel from the first edge device to the second edge device based on the QoS corresponding to the account.
The method according to any one of claims 1 to 8, further comprising:

After receiving the first access request, the network device stores information that the first user station requests to access the VPN service;

The network device determines that the second user site requests to access the VPN service, including:

The network device determines that information that the second user site requests to access the VPN service is stored.
The method according to any one of claims 1 to 9, further comprising:

After receiving the online request of the first user station, the first edge device sends the first access request to the network device.
A network device, comprising:

a receiving unit, configured to receive a first access request sent by the first edge device, where the first access request is used to request that the first user station connected to the first edge device access the virtual private network VPN service;

a processing unit, configured to: when the receiving unit receives the first access request, determine that a second user station requests access to the VPN service, and configure the first edge device and the second user a second edge device connected to the site to access the VPN service by the first user site and the second user site.
The network device according to claim 11, wherein

When the first edge device and the second edge device connected to the second user site are configured to access the VPN service by using the first user site and the second user site, the processing unit Specifically for deploying a first VPN tunnel from the first edge device to the second edge device, And deploying a second VPN tunnel from the second edge device to the first edge device, where a head end of the first VPN tunnel is associated with the first port, and a tail end of the first VPN tunnel is a second port association, the head end of the second VPN tunnel is associated with the second port, the tail end of the second VPN tunnel is associated with the first port, and the first port is the first port a port on the edge device that is connected to the first user site, and the second port is a port on the second edge device that is connected to the second user site.
A network device according to claim 12, wherein

The receiving unit is further configured to receive a second access request sent by the third edge device, where the second access request is used to request that the third user station connected to the third edge device access the VPN service ;

The processing unit is further configured to: when the receiving unit receives the second access request, determine that the first user site and the second user site access the VPN service, and deploy the Deploying a first edge device to a third VPN tunnel of the third edge device, deploying a fourth VPN tunnel from the third edge device to the first edge device, deploying from the second edge device to the a fifth VPN tunnel of the third edge device, and a sixth VPN tunnel from the third edge device to the second edge device;

The head end of the third VPN tunnel is associated with the first port, the tail end of the third VPN tunnel is associated with the third port, and the head end of the fourth VPN tunnel is associated with the third port. The trailing end of the fourth VPN tunnel is associated with the first port, the head end of the fifth VPN tunnel is associated with the second port, and the tail end of the fifth VPN tunnel is associated with the third port. The head end of the sixth VPN tunnel is associated with the third port, the tail end of the sixth VPN tunnel is associated with the second port, and the third port is the third edge device and the The port to which the third user site is connected.
The network device according to claim 12 or 13, further comprising: a sending unit;

The processing unit is further configured to allocate a VPN tunnel identifier for the VPN service;

The processing unit when deploying a first VPN tunnel from the first edge device to the second edge device and deploying a second VPN tunnel from the second edge device to the first edge device Specifically, the first configuration parameter is sent to the first edge device by using the sending unit, and the second configuration parameter is sent to the second edge device by using the sending unit.

The first configuration parameter includes: the VPN tunnel identifier, a port identifier of the first port, And the device identifier of the second edge device; the second configuration parameter includes: the VPN tunnel identifier, the port identifier of the second port, and the device identifier of the first edge device.
The network device according to claim 12 or 13, further comprising: a sending unit;

The processing unit when deploying a first VPN tunnel from the first edge device to the second edge device and deploying a second VPN tunnel from the second edge device to the first edge device Specifically, the request for deploying the first VPN tunnel and the second VPN tunnel is sent to the controller by using the sending unit, where the request for deploying the first VPN tunnel and the second VPN tunnel includes The port identifier of the first port, the port identifier of the second port, the device identifier of the first edge device, and the device identifier of the second edge device.
A network device according to any one of claims 12 to 15, wherein

The receiving unit is further configured to: the first exit request sent by the first edge device or the second exit request sent by the second edge device, where the first exit request is used to request the first user site Exiting the VPN service, the second exit request is used to request that the second user site exit the VPN service;

The processing unit is further configured to: when the receiving unit receives the first exit request or the second exit request, cancel the deployed first VPN tunnel and the second VPN tunnel.
The network device according to claim 16, further comprising: a sending unit;

The processing unit is further configured to acquire related information used to indicate deployment time of the first VPN tunnel and the second VPN tunnel;

The sending unit is configured to send the related information to a charging device.
The network device according to any one of claims 12 to 17, wherein the first access request further includes an account that the first user station requests to access the VPN service;

The processing unit is further configured to acquire a quality of service QoS corresponding to the account;

When the first VPN tunnel from the first edge device to the second edge device is deployed, the processing unit is specifically configured to deploy, according to the QoS corresponding to the account, from the first edge device to the first The first VPN tunnel of the two edge devices.
A network device according to any one of claims 11 to 18, characterized in that

The processing unit is further configured to: when the receiving unit receives the first access request, store information that the first user station requests to access the VPN service;

When it is determined that the second user site requests to access the VPN service, the processing unit is specifically configured to determine that the information that the second user site requests to access the VPN service is stored.
The network device according to any one of claims 11 to 19, wherein the first edge device sends the first access to the network device after receiving an online request of the first user site Requested device.