【作者】 梁海英；

【导师】 高远；

【作者基本信息】 东北大学 ， 计算机应用技术， 2008， 博士

【摘要】 随着Internet的快速发展,影响互联网数据传输的不安全因素不断增多,而建立物理的私用网络需要消耗大量成本。在这样的背景下,VPN(Virtual Private Network,虚拟私用网)以其独有的优势赢得了越来越多企业的青睐,利用公共网络构建的私有专用网络称为虚拟私有网络。在公共网络上组建的VPN像企业的物理私有网络一样,可以提供安全性和可管理性等。在自治域之间,由于Internet采用分布式控制路由信息方式,每个AS通过BGP与其他AS交换网络可达信息,又由于MPLS中用于分发标签的信令协议LDP在设计之初,要求LSP的建立条件是路由条目的掩码全路径相等,对AS这个元素没有进行充分考虑,这个要求对于只有BGP协议可供选择的自治域之间很难达到。基于上述原因,部署和使用跨域MPLS VPN面临诸多挑战,与域内技术相比,域间技术还不细致、不完善,具体表现为以下几个方面：如何发现可视化的VPN拓扑结构；如何检测PE或ASBR上的MP-BGP配置错误；如何平衡VPN域间流量以及恢复LSP路径故障等。本文以国家自然科学基金“域间路由稳定性与可管理性研究”为背景,对上述4个问题提出了相应的对策和解决方法。(1)为了获得VPN的成员关系及其相互连接的方式,本文提出发现VPN拓扑结构的算法,以自动获取可视化的拓扑结构,从而直观显示VPN成员相应设备的连接方式。该算法基于PE或ASBR上VRF和RT的配置数据库信息,利用矩阵模型,经过算法推导,提取相关组件,提供可视化的VPN拓扑结构。(2)本文针对MP-BGP路由源配置错误和路由输出配置错误问题,提出检测PE或ASBR上MP-BGP配置错误的方法,降低路由器负载,保证VPN的互通和安全。该方法在发现VPN拓扑结构的基础上,对输入和输出路由的VPN-IPv4前缀进行从属关系检测,以发现非授权的地址前缀；利用AS关系对路由进行有效性检测,以发现违反输出原则的路由,提高MPLS VPN的安全性。(3)本文还针对VPN中出现的域间流量不平衡问题,提出用BGP实现MPLSVPN域间流量平衡的方法,从而有效利用网络资源,提高网络的传输效率。该方法通过出界流量控制算法,在出口PE或发送的ASBR中配置LOCAL-PREF属性值,控制AS的出界流量；通过入界流量控制算法,保证客户AS不在提供者间或对等体间过渡流量,允许客户AS向它的部分提供商通告路由,或人为增加AS-PATH的长度,从而控制AS中入口PE或接收ASBR的入界流量。(4)针对标签交换路径的设计与维护问题,本文提出基于故障恢复模型的MPLS VPN动态路径管理算法,这一算法能够自动设计并维护VPN路径。该算法在提出备份路径设计准则的基础上,测试全连通MPLS VPN中备份路径可用性的条件,提出快速备份路径构造算法,在多故障发生时,可以动态地构造VPN路径,从而使满足客户故障恢复需求的VPN业务受干扰程度最小。更多还原

【Abstract】 A VPN is a network where customers have connectivity across a shared infrastructure using the same access and security policies as a.private network. In the course of research, we discovered several problems for inter-domain MPLS VPN.Aimed at the circumstance,Based on the NSF project Study on InterDomain Routing Stability and Managebility,in this dissertation, we put forward algorithms to automatically discover VPN topology,to detect MP-BGP misconfiguration on PE or ASBR,to manage the inter-domain routes and to effectively balance inter-domain traffic and to dynamically manage MPLS VPN path.Firstly, in order to grasp clearly the membership, we put forward to an algorithm to discover MPLS VPN topology. Algorithms aims at automating this VPN discovery procedure based on VRF and RT.Secondly, we put forward to the algorithm to detect MP-BGP misconfiguration on PE or ASBR in MPLS VPN. This algorithm can decrease the update load on routers, and avoid disrupting Internet connectivity. We mainly study the origin misconfiguration and export misconfiguration. In this method, the inbound routes and outbound routes are detected for origin errors according to the relationship between the prefixes and ASes which announce the prefixes. We use the commercial relationships between ASes to detect routes and further find routes violating export guidelines.Thirdly, in MPLS VPNs, traffic engineering achieved by using MPLS was predominantly limited to intra-domain and single administrative domain. However with the rapid expansion of enterprise scale, a VPN has spanned a large number of administrative domains. Thus effective management of inter-domain traffic is urgently demanded. We put forward to methodology to balance the inter-domain traffic in MPLS VPNs by BGP. Presented the simplest method is on the basis of various BGP attributes, BGP import or export routing policy and AS relationship constructed according to bilateral economical agreements. For this, they can rely on the LOCAL-PREF attribute to control the routes that will be chosen for the packets that leave each BGP router of the provider. In order to balancing incoming traffic, ASes are allowed announce their prefixes to a selected subset of providers instead of all providers.Finally, in MPLS VPN, the connectionless IP traffic of the VPN site transits MPLS backbone by connect-oriented LSP, in many cases, LSP was designed manually by network manager, we put forward to the algorithm to dynamically manage MPLS VPN path based on failure recover model. In this article, we present a methodology for MPLS VPN service management employing a resilience model. The methods can dynamically configure the service paths of MPLS VPN satisfying the TE resilience requirement from the customers. Specifically, we describe backup path design rules and derive the conditions for testing the availability of feasible backup paths satisfying the resilience constraints in a full mesh MPLS VPN. We present fast backup path construction algorithms which could make the MPLS VPN service to be available with minimal disruption, satisfying the resilience requirement from the customers.更多还原