The distribution method of nat port resource in a kind of distributed system
Technical field
The present invention relates to network communications technology field, relate in particular to the distribution method of nat port resource in a kind of distributed system.
Background technology
NAT (Network Address Translation, network address translation) is the short scheme in a kind of IPv4 of solution address commonly used at present.In the business outlet of the network egress of second-level runner or large enterprise's (surpassing ten thousand people), gateway device will have nat feature.Under this scene since to handling performance requirements than higher, the performance of centralized device has satisfied not requirement, the gateway device of deployment is distributed apparatus normally.
In the practical application, network address translation can only be changed the IP address, also can change the port of IP address and TCP/UDP agreement simultaneously.That application is maximum in the gateway device is the latter, and the NAT that mentions in the file of the present invention is meant the latter.The several legal outside ip address of configuration on gateway, the All hosts of internal network just can be realized the visit to Internet through sharing this several IP address, thereby can practice thrift the IP address resource to greatest extent.
A series of messages that intranet host is initiated with identical source IP address, source port, purpose IP address, destination interface, agreement, corresponding message flow.In gateway device,, can set up a session status in order to handle this message flow.Each session status has all been preserved a NAT transitional information (Intranet IP: Intranet port-public network IP: the public network port).Gateway device can utilize this session status, with the IP and the port of intranet host, converts the IP and the port of public network into.Each public network IP can provide 64K port, can use for 64K session status.
Particularly, carrying out the ftp download such as intranet host 1, gateway can convert the information (192.168.1.1:2000) of main frame 1 into the information (10.10.10.10:3000) of public network.Intranet host 2 is carrying out browsing page, and gateway can convert the information (192.168.1.2:2000) of main frame 2 into the information (10.10.10.10:4000) of public network.
In distributed system, comprise this integrated circuit board of two types of control board and business board referring to Fig. 1 at least.Work such as wherein control board is responsible for complete machine control scheduling, routing table is learnt and issue.Business board is responsible for work such as table look-up in this locality, business board state-maintenance, session status maintenance, safety service function treatment.The foundation of session status and use were divided into for two steps: session status is set up in (1): wherein, first message of message flow can trigger and set up session status, comprises the NAT transitional information; (2) use session status: after session status was set up, follow-up message will use session status to transmit.Comprise and use the transitional information of NAT to carry out the conversion of IP address and port.
In distributed apparatus, have the polylith business board.Business board can follow-up increase.Begin only to have bought 3 business boards (business board 1, business board 2, business board 3) such as the user,, need the disposal ability of raising system, can increase a business board (business board 4) more afterwards owing to professional development.
Current a kind of implementation commonly used is: keep all of the port resource on the control board, reserved port resource not on the business board.Referring to Fig. 2, arrow is represented the flow direction of message among the figure.Suppose and only disposed a public network IP (10.10.10.10) on the equipment, preserved 64K all port resource of this public network IP address so on the control board.
The foundation of session status and use: session status is set up in (1): first message (192.168.1.1:2000) will pass through business board earlier; Send to control board then and obtain the transitional information (192.168.1.2:2000->10.10.10.10:3000) of NAT, be kept at session status on the business board then; (2) use session status: follow-up message utilizes the session status of preserving on the business board, directly on business board, transmits.
The defective that this implementation exists is: autgmentability is bad, and all set up the process of session status all will pass through control board, and very high to the control board requirement, under the situation that has disposed a lot of piece business boards, the handling property of control board will become bottleneck; The process lag of newly-built session status is big, and first message of newly-built session status all will cause the delay of message big around control board once, is for user's reaction directly perceived, and speed is slack-off, and the speed such as browsing page in the application is slack-off.
Current another implementation commonly used is: business board is divided equally all port resources, reserved port resource not on the control board.
Specifically referring to Fig. 3, supposing the system initially has 3 business boards (business board 1, business board 2, business board 3), has only disposed a public network IP address (10.10.10.10), has so kept about 21K port resource respectively on every business board.The port resource that keeps on each business board is in system initialization, to determine.At system's run duration, can not dynamic adjustments.Port resource between the business board can not be used each other.
The foundation of session status and use: session status is set up in (1): first message (192.168.1.2:2000) is only through business board; Just can obtain the transitional information (192.168.1.2:2000->10.10.10.10:4000) of NAT, be kept at (need not pass through control board handles) on the business board to session status then; (2) use session status: follow-up message utilizes the session status of preserving on the business board, directly on business board, transmits.
The defective that this implementation exists is: port resource may form bigger waste, under the uneven situation of business, may occur also having port resource on the business board 1, but the situation that the port resource on business board 2 and the business board 3 has exhausted; The not hot plug of supporting business plate when inserting or extracting business board, can not need be restarted system automatically for business board distributes or the recovery port resource, causes suspension.Such as the first step, insert business board 4 now, remain business board 1, business board 2, business board 3 each have 21K port resource, the business board 4 automatic reserved port resource of having no idea.Restart after the system, the port resource that keeps on each business board is 16K, second step; Extract business board 4 again, have no idea to reclaim automatically the port resource on the business board 4, business board 1; Business board 2, still 16K port resource separately on the business board 3 restarted after the system; The port resource that (business board 1, business board 2, business board 3) keeps on each business board reverts to 21K.
Therefore, need a urgent technical problem that solves to be exactly instantly: how can propose a kind of effective measures, to solve the defective that exists in the prior art.
Summary of the invention
Technical problem to be solved by this invention provides the distribution method of nat port resource in a kind of distributed system, effectively reduces the delay that message is handled, and improves user's experience.
In order to solve the problems of the technologies described above, the invention provides the distribution method of nat port resource in a kind of distributed system, comprising:
First message of first session status is when a certain business board, and the NAT module that triggers the current business plate is to N port resource of the NAT of control board module application, and gets a port;
First message obtains the transitional information of the port of getting, and first session status is kept at the current business plate;
The subsequent packet of first session status is transmitted on the current business plate according to the session status of preserving on the current business plate;
When first message of subsequent session state passes through the current business plate; The NAT module of this business board is got a port from a remaining N-1 port; First message of this subsequent session state obtains the transitional information of the port of getting, and this subsequent session state is kept at the current business plate;
The subsequent packet of this subsequent session state is transmitted on the current business plate according to the session status of preserving on the current business plate.
Further, the span of said N is 2
4~2
12
Further, the distribution method of nat port resource also comprises in the described distributed system:
The application threshold values is set and discharges threshold values, the Number of Available/Faulty Ports of this plate of business board statistics, when Number of Available/Faulty Ports during less than the application threshold values, business board is to master control borad application port resource; When Number of Available/Faulty Ports when discharging threshold values, business board is to master control borad release port resource.
Further, when control board middle port resource was lower than the applications of a certain business board, control board reclaimed untapped port resource in other business boards of current distributed system, distributed to the business board of current application port resource.
Further, said transitional information specifically is that IP and the port of intranet host is to the IP of public network and the transitional information of port.
Further, said message comprises source IP address, source port, purpose IP address, destination interface and agreement.
Further, each public network IP provides 64K port, supplies 64K session status to use.
Further, when said control board middle port resource was lower than the applications of a certain business board, control board reclaimed untapped port resource in other business boards of current distributed system, distributed to the business board of current application port resource, specifically comprised:
Control board is collected the port resource information of business board;
Obtain untapped port resource in the collected resource information;
Reclaim and do not use port resource and it is belonged to the NAT module to control board;
Control board NAT module assignment port resource is given the business board of application port resource.
Further, said mode of getting a port is a random fashion or according to the mode of port numbering size order.
Further, said business board comprises existing business plate and Added Business plate.
To sum up, the distribution method of nat port resource has following beneficial effect in the distributed system provided by the invention:
1, avoids the bottleneck of control board handling property;
2, reduce the process lag of newly-built session status;
3, port resource obtains global assignment, has avoided the waste of port resource;
4, realized the hot plug of business board.
Description of drawings
Fig. 1 is the sketch map of the distributed system described in the background technology of the present invention;
Fig. 2 is the sketch map of distributed system in a kind of implementation described in the background technology of the present invention;
Fig. 3 is the sketch map of distributed system in the another kind of implementation described in the background technology of the present invention;
Fig. 4 is the schematic flow sheet of the distribution method of nat port resource in a kind of distributed system described in the embodiment of the present invention;
Fig. 5 is the distributed system sketch map in the practical application described in the embodiment of the present invention;
Fig. 6 is the sketch map of the application example described in the embodiment of the present invention.
Embodiment
Below in conjunction with accompanying drawing and embodiment the present invention is done further detailed explanation.
The schematic flow sheet of the distribution method of nat port resource in reference a kind of distributed system shown in Figure 4 specifically comprises:
S101, first message of first session status are when a certain business board, and the NAT module that triggers the current business plate is to N port resource of the NAT of control board module application, and get a port;
S102, first message obtains the transitional information of the port of getting, and first session status is kept at the current business plate;
S103, the subsequent packet of first session status transmit on the current business plate according to the session status of preserving on the current business plate;
Distributed system sketch map in the practical application has NAT module (global pool) referring to Fig. 5 on the control board, keep all of the port resource, carries out the overall situation unified distribution of port resource.Business board once applies for more port resource to the NAT-global pool that application range is 2 usually when needed through NAT module-local pond
4~2
12, also be 16~4096.As: first message (192.168.1.3:2000) of first session status can trigger the NAT module-local pond of business board 1 and come the port resource (port 5000-port 5999) to NAT-global pool application 1K through business board (being assumed to be business board 1) time.First message has obtained the transitional information (192.168.1.3:2000->10.10.10.10:5000) of NAT, is kept at session status 1 on the business board then.This moment, the NAT module-local pond of business board 1 also had 999 port resources.The follow-up message of first session status utilizes the session status of preserving on the business board 1, directly on business board 1, transmits.
Wherein, transitional information specifically is that IP and the port of intranet host is to the IP of public network and the transitional information of port.Message comprises source IP address, source port, purpose IP address, destination interface and agreement.Each public network IP provides 64K port, supplies 64K session status to use.
S104; When first message of subsequent session state passes through the current business plate; The NAT module of this business board is got a port from a remaining N-1 port, first message of this subsequent session state obtains the transitional information of the port of getting, and this subsequent session state is kept at the current business plate;
S105, the subsequent packet of this subsequent session state transmit on the current business plate according to the session status of preserving on the current business plate.
When first message (192.168.1.4:2000) of second session status passed through business board 1,1 port was just taken out from remaining 999 port resources in the NAT module of business board 1-local pond.This message has obtained the transitional information (192.168.1.4:2000->10.10.10.10:5001) of NAT, is kept at session status 2 on the business board then.Second follow-up message of session status utilizes the session status of preserving on the business board 2, directly on business board 1, transmits.
The subsequent session state and second session status are adopted in the same way and are handled.
In practical application, also have the demand of inserting or extracting business board; As business board 1, business board 2 and business board 3 are arranged in the existing compartment system; Need to insert business board 4 now; When business board 4 is received message, port resource can be distributed automatically in the NAT module of business board 4-local pond from the NAT module-global pool of control board, such as 1K port resource.Again or during the later stage uses, when no longer needing business board 4, it is extracted, at this moment the NAT module-global pool of control board can all reclaim this 1K port resource in NAT module-local pond on the original business board 4.
When control board middle port resource was lower than the applications of a certain business board, control board reclaimed untapped port resource in other business boards of current distributed system, distributed to the business board of current application port resource.Particularly; Control board is collected the port resource information of business board; Obtain untapped port resource in the collected resource information, reclaim and do not use port resource and it is belonged to the NAT module to control board, control board NAT module assignment port resource is given the business board of application port resource.
Thereby control board can be coordinated the port resource between the business board through the operating position of the port resource of each business board NAT of monitoring.As also having port resource on the business board 1; But the port resource on business board 2 and the business board 3 exhausts; Again or business board 4 when control board application port resource, port resource situation in short supply appears in control board, control board can be recovered to the port resource in NAT module-local pond on the business board 1 on the control board in NAT module-global pool; Transfer to as required then in the NAT module-local pond on business board 2 and the business board 3, or distribute to business board 4.
In addition, also can be through the application threshold values being set and discharging threshold values and realize the regulation and control of port resource, particularly, and the Number of Available/Faulty Ports of this plate of business board statistics, when Number of Available/Faulty Ports during less than the application threshold values, business board is to master control borad application port resource; When Number of Available/Faulty Ports when discharging threshold values, business board is to master control borad release port resource.Business board described in the literary composition comprises existing business plate and Added Business plate.
Below through concrete application example scheme according to the invention is done further to introduce: specifically referring to Fig. 6, some bandwidth operator are that 2 sub-districts provide broadband access network professional, and 1 has disposed distributed system respectively with sub-district 2 in the sub-district.NAT transformation rule of configuration on the distributed system of sub-district 1: the message that Intranet (belonging to IP network section 192.168.1.0/24) is come all is transformed into public network IP address (10.10.10.10).NAT transformation rule of configuration on the distributed system of sub-district 2: the message that Intranet (belonging to IP network section 192.168.2.0/24) is come all is transformed into public network IP address (20.20.20.20).
In sub-district 1, the beginning number of users is less, and in order to protect the initial input of this bandwidth operator, distributed system has only disposed 3 business boards.After operation a period of time, number of users increases a lot, and 3 business board disposal abilities are not enough.This bandwidth operator has bought a business board again.In escalation process, can directly be inserted into business board in the machine frame and get final product.Need not change configuration and restart system.Avoided interrupting the user's in the sub-district 1 service disconnection.Whole upgrade process, user's perception less than.
Likewise, above-mentioned operation and upgrade mode also can be adopted in sub-district 2.
Need to prove that the distribution method of nat port resource can be widely used in the business outlet of network egress or large enterprise of various second-level runners in the distributed system of the present invention.
More than the distribution method of nat port resource in a kind of distributed system provided by the present invention has been carried out detailed introduction; Used concrete example among this paper principle of the present invention and execution mode are set forth, the explanation of above embodiment just is used for helping to understand method of the present invention and core concept thereof; Simultaneously, for one of ordinary skill in the art, according to thought of the present invention, the part that on embodiment and range of application, all can change, in sum, this description should not be construed as limitation of the present invention.