CN107241208A - A kind of message forwarding method, the first interchanger and related system - Google Patents

Abstract

The embodiment of the present application discloses a message forwarding method, a first switch and a related system, the method includes: the first switch receives a plurality of messages from the first network, The firewall sends multiple packets, and the packets sent by the first switch to the first firewall and the second firewall are the same, so that both the first firewall and the second firewall establish a session header according to the session header packets in the multiple packets. The session table item of the session to which the message belongs, the session table item includes a quintuple, and the quintuple is used to judge whether the message flowing through the firewall belongs to the session; the first switch receives the session message from the second network sent by the first firewall message: the first switch forwards the message from the session of the second network to the first network. With this application, when the first firewall fails, the second firewall can take over the services of the first firewall based on the session entry established by itself, thereby avoiding service interruption.

Description

A message forwarding method, first switch and related system

technical field

The present invention relates to the field of computer technology, in particular to a message forwarding method, a first switch and related systems.

Background technique

Virtual machine software (Virtual Machine ware, VMware), Kernel-based Virtual Machine (Kernel-based Virtual Machine, KVM) and other environments virtualization technology principle is to virtualize the physical resources of a physical machine into multiple virtual machines (Virtual Machine, VM ), so that each VM can realize the function of a physical machine. With the continuous evolution of Network Function Virtualization (NFV), many traditional gateways, such as firewalls and routers, will be deployed on virtual machines. The mutual backup disaster recovery mechanism between multiple virtual machines can avoid the interruption of the business carried by the network traffic during the operation of the gateway.

Please refer to FIG. 1. FIG. 1 is a schematic diagram of a firewall based on virtual technology in the prior art, that is, a virtual firewall, forwarding a message. In addition to virtual firewalls taking virtual firewall 101 and virtual firewall 102 as examples, There are other virtual firewalls, and Figure 1 only uses two virtual firewalls as an example for illustration. The virtual firewall 101 and the virtual firewall 102 form a backup group 100 through a virtual router redundancy protocol (Virtual Router Redundancy Protocol, VRRP). Virtual firewalls other than the primary virtual firewall are standby virtual firewalls. The primary firewall performs packet filtering or policy matching on packets based on session entries. When the primary virtual firewall fails, the backup group 100 will re-elect a virtual firewall as the new primary virtual firewall, and the packets sent by the switches 103 and 104 to the backup group 100 will only be received and forwarded by the primary virtual firewall the message.

The disadvantage of the prior art is that the firewall usually performs packet filtering or policy matching on packets based on session entries. Therefore, the current active virtual firewall needs to periodically back up the session entries on the current active virtual firewall to the current standby virtual firewall to ensure that the standby virtual firewall can take over the session entries based on the backed up session entries when the active virtual firewall fails. Services on the primary virtual firewall. If the session entry is not backed up in time, some services will be interrupted.

Contents of the invention

The embodiment of the invention discloses a service forwarding method, a first switch and a related system, which can solve the problem of service interruption caused by not backing up session entries in time.

In a first aspect, an embodiment of the present invention provides a service forwarding method, the method including:

The first switch receives multiple messages from the first network, the first switch is connected to the first firewall, the second firewall and the first network, and the multiple messages are the first network and the second network. For messages transmitted between the two networks, the first firewall is the active firewall, the second firewall is the backup firewall, the first firewall and the second firewall are respectively connected to the first switch and the second switch, The second switch is also connected to the second network;

The first switch sends the plurality of packets to the first firewall and the second firewall respectively, and the packets sent by the first switch to the first firewall and the second firewall are the same so that both the first firewall and the second firewall establish a session entry for the session to which the session header packet belongs according to the session header packets in the plurality of packets, and the session entry includes five elements group, the five-tuple is used to determine whether the message flowing through the firewall belongs to the session;

receiving, by the first switch, the packet of the session from the second network sent by the first firewall;

The first switch forwards the packet of the session from the second network to the first network.

By performing the above steps, the first switch sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that , the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the services on the first firewall based on the session entry established by itself, avoiding business interruption.

With reference to the first aspect, in a first possible implementation manner of the first aspect, after the first switch sends the multiple packets to the first firewall and the second firewall respectively, the method further include:

The first switch detects whether the first firewall fails, or whether the link between the first switch and the first firewall is interrupted;

If the first switch detects that the first firewall fails, or the link between the first switch and the first firewall is interrupted, the first switch receives and forwards the packets from the session on the second network.

With reference to the first possible implementation of the first aspect, in a second possible implementation of the first aspect, the first switch detects whether the first firewall fails, specifically:

The first switch detects whether the first firewall is faulty through a bidirectional forwarding detection mechanism BFD.

Specifically, the switch itself detects whether the first firewall is faulty, so as to adjust the packet forwarding policy in time when the first firewall is detected to be faulty, thereby improving the performance of the switch.

With reference to the first possible implementation of the first aspect, or the second possible implementation of the first aspect, in a third possible implementation of the first aspect, the first switch detects that the first Before a firewall fails, or the link between the first switch and the first firewall is interrupted, the method further includes:

The first switch does not receive the session packet from the second network sent by the second firewall, or receives and discards the packet from the second network sent by the second firewall. Session messages.

With reference to the third possible implementation manner of the first aspect, in a fourth possible implementation manner of the first aspect, the first switch includes a first interface connecting the first switch to the first firewall, and a second interface connecting the first switch to the second firewall,

Before the first switch detects that the first firewall fails, or the link between the first switch and the first firewall is interrupted, the first interface is set as the main interface, and the second interface It is set as a backup interface; the first switch receives and forwards the message of the session from the second network sent by the first firewall through the first interface, and the first switch does not receive the receiving the session packet from the second network sent by the second firewall, or receiving the session packet from the second network sent by the second firewall through the standby interface, and discarding the packets received from the session of the second network through the standby interface;

After the first switch detects that the first firewall fails, or the link between the first switch and the first firewall is interrupted, the method further includes:

Setting the first interface as a standby interface, setting the second interface as a main interface, receiving and forwarding the session from the second network sent by the second firewall through the second interface message.

In a second aspect, an embodiment of the present invention provides a first switch, where the first switch includes a network interface, a processor, and a memory, wherein:

The network interface is used to receive messages and send messages;

The memory is used to store instructions and data;

The processor is configured to read instructions and data stored in the memory, and perform the following operations:

Receive a plurality of messages from the first network through the network interface, the first switch is connected to the first firewall, the second firewall and the first network, and the plurality of messages are the first network For messages transmitted between the second network and the first firewall, the first firewall is the active firewall, the second firewall is the backup firewall, the first firewall and the second firewall are connected to the first switch and the second switch respectively connected, the second switch is also connected to the second network;

Send the multiple packets to the first firewall and the second firewall respectively through the network interface, and the packets sent to the first firewall and the second firewall through the network interface are the same so that both the first firewall and the second firewall establish a session entry for the session to which the session header packet belongs according to the session header packets in the plurality of packets, and the session entry includes five elements group, the five-tuple is used to determine whether the message flowing through the firewall belongs to the session;

receiving the packet of the session from the second network sent by the first firewall through the network interface;

Forwarding the packet of the session from the second network to the first network through the network interface.

By performing the above operations, the first switch sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that , the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the services on the first firewall based on the session entry established by itself, avoiding business interruption.

With reference to the second aspect, in a first possible implementation manner of the second aspect, after the processor sends the multiple packets to the first firewall and the second firewall respectively through the network interface, The processor is also used to:

Detecting whether the first firewall fails, or whether the link between the first switch and the first firewall is interrupted;

If the first firewall fails, or the link between the first switch and the first firewall is interrupted, receive and forward the data from the second network sent by the second firewall through the network interface. packets of the session.

With reference to the first possible implementation of the second aspect, in a second possible implementation of the second aspect, the processor detects whether the first firewall fails, specifically:

A bidirectional forwarding detection mechanism BFD is used to detect whether the first firewall is faulty.

Specifically, the switch itself detects whether the first firewall is faulty, so as to adjust the packet forwarding policy in time when the first firewall is detected to be faulty, thereby improving the performance of the switch.

With reference to the first possible implementation of the second aspect, or the second possible implementation of the second aspect, in a third possible implementation of the second aspect, the processor detects that the first Before the firewall fails, or the link between the first switch and the first firewall is interrupted, the processor is further configured to:

Not receiving the session packet from the second network sent by the second firewall, or receiving the session packet from the second network sent by the second firewall through the network interface packets, and discard the packets sent by the second firewall from the session on the second network.

With reference to the third possible implementation manner of the second aspect, in a fourth possible implementation manner of the second aspect, the network interface includes a first interface connecting the first switch to the first firewall, and the second interface connecting the first switch to the second firewall,

Before the processor detects that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, the first interface is set as the main interface, and the second interface is set as the main interface. set as a backup interface; the first switch receives and forwards the message from the session of the second network sent by the first firewall through the first interface, and the first switch does not receive the receiving the session packet from the second network sent by the second firewall, or receiving the session packet from the second network sent by the second firewall through the second interface, and discarding the packets received through the second interface from the session of the second network;

After the processor detects that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, the first interface is set as the standby interface, and the second interface is set to Set as the main interface, receive and forward the message from the session of the second network sent by the second firewall through the second interface.

In a third aspect, an embodiment of the present invention provides a first switch, where the first switch includes a functional unit configured to perform some or all of the steps in any implementation manner of the first aspect of the embodiments of the present invention.

In a fourth aspect, an embodiment of the present invention provides a message forwarding system, the system includes a first switch, a second switch, a first firewall, and a second firewall, wherein the first switch communicates with the first firewall, the second The firewall is connected to the first network, the first firewall is an active firewall, the second firewall is a backup firewall, the first firewall and the second firewall are respectively connected to the first switch and the second switch, The second switch is also connected to the second network, wherein:

The first switch is configured to receive multiple packets from the first network, the multiple packets are packets transmitted between the first network and the second network; The second firewall sends the plurality of packets, and the packets sent by the first switch to the first firewall and the second firewall are the same;

The first firewall and the second firewall are respectively configured to establish a session entry of the session to which the session header message belongs according to the session header message in the plurality of messages sent by the first switch, so The session entry includes a quintuple, and the quintuple is used to determine whether the message flowing through the firewall belongs to the session;

The first firewall is further configured to forward the packet of the session from the second network to the first switch;

The first switch is further configured to receive the packet of the session from the second network sent by the first firewall;

The first switch is further configured to forward the packet of the session from the second network to the first network.

By running the system, the first switch sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that , the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the services on the first firewall based on the session entry established by itself, avoiding business interruption.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the first switch includes a first interface connecting the first switch to the first firewall, and the first switch is connected to the first A second interface connected to the second firewall, the second firewall is further configured to forward the message from the session of the second network to the first switch;

The first switch is configured to detect whether the first firewall is faulty, or whether the link between the first switch and the first firewall is interrupted, and when the first firewall is detected to be faulty, or the Before the link between the first switch and the first firewall is interrupted, the first interface is set as the main interface, and the second interface is set as the backup interface; when the failure of the first firewall is detected, or After the link between the first switch and the first firewall is interrupted, the first interface is set as a standby interface, and the second interface is set as a main interface;

Before the failure of the first firewall is detected, or the link between the first switch and the first firewall is interrupted, receiving the first firewall and the first firewall through the first interface and the second interface respectively The second firewall sends the packet from the session of the second network, and discards the packet received through the second interface from the session of the second network;

After detecting that the first firewall is faulty or the link between the first switch and the first firewall is interrupted, respectively receive the data from the second firewall sent by the second firewall through the second interface. A message of the session of the second network, and forward the message of the session of the second network received through the second interface to the first network.

With reference to the fourth aspect, in a second possible implementation of the fourth aspect, the second firewall is also used to detect whether the second firewall is a backup firewall, and if the second firewall is a backup firewall, prohibiting the The first switch forwards the packets of the session from the second network, and prohibits forwarding the packets of the session from the first network to the second switch.

By implementing the embodiment of the present invention, the first switch sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, thus First, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the business on the first firewall based on the session entry established by itself. , avoiding business interruption.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings that are required in the description of the embodiments or the prior art.

FIG. 1 is a schematic diagram of a scenario of firewall forwarding services based on virtual technology in the prior art;

FIG. 2 is a schematic flowchart of a service forwarding method provided by an embodiment of the present invention;

FIG. 3 is a schematic diagram of a service forwarding scenario provided by an embodiment of the present invention;

FIG. 4 is a schematic diagram of a logical link scenario provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a first switch provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of another first switch provided by an embodiment of the present invention;

Fig. 7 is a schematic structural diagram of a message forwarding system provided by an embodiment of the present invention.

detailed description

The technical solutions of the embodiments of the present invention will be described in detail below with reference to the drawings of the embodiments of the present invention.

Please refer to FIG. 2 . FIG. 2 is a schematic flowchart of a service forwarding method provided by an embodiment of the present invention. The method includes but is not limited to the following steps.

Step S201: the first switch receives multiple packets from the first network.

In order to better understand the solution of the embodiment of the present invention, first, referring to FIG. 3 , the application scenario of the embodiment of the present invention is introduced. In Fig. 3, the first switch 311 is connected with the first firewall 312, the second firewall 313 and the first network, and the second switch 314 is connected with the first firewall 312, the second firewall 313 and the second network, and the first firewall 312 is The active firewall, the second firewall 313 is a standby firewall, the first switch 311 and the second switch 314 both know that the first firewall 311 is the active firewall, and know that the second firewall 314 is a standby firewall; in the first network There are one or more clients, and there are also one or more clients in the second network. No matter what message the client in the first network sends to the client in the second network, the The message is sent to the first switch 311. The above-mentioned "multiple messages" can be sent at the same time, and can also be sent successively within a period of time. The "multiple" in the above-mentioned "multiple messages" is intended not to Limit the type of packets sent. Correspondingly, the first switch 311 receives the message sent from the first network.

It should be noted that the first firewall 312 and the second firewall 313 in the embodiment of the present invention have the same external address information, for example, have the same virtual Internet Protocol (Internet Protocol, IP) address and virtual media access control ( Media Access Control (MAC) address, the source address of the message sent by the first firewall 312 to the first switch 311 is the same as the source address of the message sent by the second firewall 313 to the first switch 311, the first The source address of the packet sent by the firewall 312 to the second switch 314 is the same as the source address of the packet sent by the second firewall 313 to the second switch 314 . Optionally, the first firewall 312 and the second firewall 313 may be virtual firewalls or physical firewalls, and the first switch 311 and the second switch 314 may be virtual switches or physical switches.

In an optional solution, the first switch 311 includes a first interface 3111 and a second interface 3112, and the second switch 314 includes a third interface 3141 and a fourth interface 3142, and the first switch 311 uses the The first interface 3111 is connected to the first firewall 312 to form a first link 315 connecting the first switch 314 and the first firewall 312, and the first switch 311 is connected to the second firewall 313 through the second interface 3112 to form a The second link 316 connecting the first switch 311 and the second firewall, the second switch 314 is connected with the first firewall 312 through the third interface 3141, forming a third link connecting the second switch 314 and the first firewall 312 The second switch 314 is connected to the second firewall 313 through the fourth interface 3142 to form a fourth link 318 connecting the second switch 314 and the second firewall 313 . As shown in Figure 4, the first link 315 and the second link 316 can be bundled together to form a logical link through link aggregation, and the firewall in Figure 4 actually refers to the first firewall 312 and the second firewall 313, not drawn separately. Similarly, the third link 317 and the fourth link 318 are bundled together by means of link aggregation to form a logical link. The link aggregation can be manual link aggregation or static link aggregation control Protocol (Link Aggregation Control Protocol, LACP) link aggregation. Both the first switch 311 and the second switch 314 can be based on the preset active/standby relationship between the first firewall 312 and the second firewall 313, and detect the running status of the first firewall 312 and the second firewall 313, and then based on the active/standby relationship and operating status to determine which link to use, the first switch 311 and the second switch 314 can switch the interface on the link to be used through the eth-trunk mechanism to the main interface, that is, the interface with a higher priority, so that the report Files can be sent and received through the link corresponding to the main interface. For the sake of brevity in the description, numbers will not be indicated when describing various devices, interfaces, links, etc., for example, the first switch 311 is described as the first switch without the number 311 .

Step S202: the first switch sends the multiple packets to the first firewall and the second firewall respectively.

Specifically, after receiving the multiple packets, the first switch forwards the multiple packets to the first firewall and the second firewall respectively, and the multiple packets sent by the first switch to the first firewall and The multiple packets sent to the second firewall are the same. For example, the first switch sends the multiple packets through the first interface and the second interface to implement sending the multiple packets to the first firewall and the second firewall. The first switch can send the plurality of messages to the first firewall and the second firewall at the same time, and can also send them in sequence. When sending them in sequence, there is no restriction on which one is sent first and which one is sent later. Preferably, the The first switch sends the multiple packets to the first firewall and the second firewall at the same time.

Step S203: the first firewall and the second firewall receive the packet sent by the first switch, judge whether there is a header packet in the received packet, and if so, establish a session according to the header packet.

Specifically, the first firewall and the second firewall each receive the message sent by the first switch, and respectively analyze the received message to determine whether the received message contains the first message; The first message explains that a session needs to be established before client A in the first network communicates with client B in the second network. After the session is established, data can be transmitted based on the session. Client A and client B The establishment of a session needs to be realized by sending the first message, which is the SYN (full name: synchronous) message in the three-way handshake process when establishing a TCP/IP connection. After the session is established between client A and client B, A data packet can then be sent based on the session to transmit data. After receiving the message, the first firewall and the second firewall analyze the message to determine whether the received message is the first message or the data message after the session is established.

When the first firewall judges that the received message is the first message, it obtains the five-tuple contained in the first message, and the five-tuple includes: source IP address, source port, destination IP address, destination port and protocol number , and then establish a session entry according to the quintuple, and the session entry contains the information of the quintuple; similarly, when the second firewall determines that the received packet is a header packet, it also obtains the header packet 5-tuple in the 5-tuple and establish a session entry based on the 5-tuple; since the first switch sends the same message to the first firewall and the second firewall, as long as the first message sent does not appear in the transmission process In the case of packet loss, the first firewall and the second firewall will establish the same session entry based on the same received first packet.

The "quintuple" in the embodiment of the present invention is illustrated below, assuming that the IP address of the client A is 192.168.1.1, and the user abc uses port 20000 to initiate a TCP connection to the client B, through the File Transfer Protocol (File Transfer Protocol) , FTP) to download files from client B, the IP address of client B is 1.1.1.1, and the port number of the service is 30000, then the first message sent by client A to client B contains the quintuple information such as Table 1 shows.

source IP address source port Destination IP address destination port protocol 192.168.1.1 20000 1.1.1.1 30000 TCP

Table 1

The five-tuple is used by the first firewall and the second firewall to determine whether the subsequent received message is a message of the session that has been established. If the received message is analyzed after the received message is found If the included quintuple is the same as the quintuple in the established session, it indicates that the received message belongs to the message of the above session. It should be noted that although the source IP and destination IP addresses in Table 1 and Table 2 are swapped, and the source port and destination port are swapped, the quintuple shown in Table 2 is the same as the quintuple shown in Table 1. Groups are the same.

source IP address source port Destination IP address destination port protocol 1.1.1.1 30000 192.168.1.1 20000 TCP

Table 2

In an optional solution, the first firewall and the second firewall can also establish a session based on a seven-tuple, and the seven-tuple adds two factors of "application" and "user" on the basis of the five-tuple, For example, the "application" is the above-mentioned FTP, and the "user" is the above-mentioned abc. It should be noted that, when judging whether a packet is a packet of an established session, in addition to judging whether the packet contains the above-mentioned five-tuple or seven-tuple, it may also be necessary to judge whether the packet contains other factors , and other factors are not limited here.

Step S204: the first firewall forwards the received packet to the second switch.

Specifically, when the packet received by the first firewall contains the first packet, in addition to establishing a session based on the first packet, the first firewall also judges its own Is it a standby firewall or an active firewall? If it is an active firewall, the first firewall forwards the first packet to the second switch. Since the first firewall is initially configured as an active firewall, the first firewall The first packet will be forwarded to the second switch; in another optional solution, the first firewall does not judge whether it is the active firewall or the standby firewall, but directly forwards the received first packet to the the second switch. The first packet is finally sent to the client B through the second switch so as to establish a session between the client A and the client B.

Further, when the first firewall receives a data packet other than the first packet in the packet sent by the first switch, the first firewall judges whether the data packet is the session If the data packet is a packet of the session corresponding to the entry, in an optional solution, after the first firewall knows that it is the active firewall, it policy or forwarding policy to process the message, for example forwarding the data message to the second switch according to the policy corresponding to the session; in yet another optional solution, the first firewall directly forwards the received The data packet is forwarded to the second switch.

The packet processing method of the second firewall is similar to that of the first firewall. When the packet received by the second firewall contains the first packet, in addition to establishing a session based on the first packet, in an optional solution, the second firewall will also determine that it is a standby firewall It is still the active firewall. If it is a backup firewall, the second firewall discards the first packet after receiving the first packet and establishing a session based on the first packet. Since the second firewall is initially configured as a backup Firewall, so the second firewall will discard the first packet. In yet another optional solution, the second firewall does not judge whether it is an active firewall or a standby firewall, but directly forwards the received first packet to the second switch.

Further, when the second firewall receives a data packet other than the first packet in the packet sent by the first switch, the second firewall judges whether the data packet is the session entry according to the established session entry. Item corresponding to the message of the session, if the data message is the message of the session, in an optional solution, after the second firewall learns that it is a backup firewall, the data message is discarded; In an optional solution, the second firewall directly forwards the received data packet to the second switch.

The following example illustrates how the first firewall and the second firewall determine whether they are active firewalls or backup firewalls: For example, when the first firewall and the second firewall are in the same backup group in the VRRP protocol, the first firewall and the second firewall The second firewall can know its own priority in the backup group through the VRRP protocol. If the priority of the first firewall is not the highest, it indicates that the first firewall belongs to the backup firewall in the backup group. If the first firewall If the priority of the second firewall is not the highest, it indicates that the second firewall belongs to the standby firewall in the backup group. The highest priority of the second firewall indicates that the second firewall belongs to the active firewall in the backup group; the first firewall can also learn the level of its own priority through other methods, for example, the first switch or the second switch A notification message is sent to the second firewall and the second firewall to inform which one is the active firewall and which one is the standby firewall.

Step S205: the second switch sends the message from the second network to the first firewall.

Specifically, when the session between client A and client B is successfully established, client B can send the message of the session to client A through the second network, and when the sent message of the session is forwarded to the After the second switch, the second switch forwards the received message to the first firewall and the second firewall, for example, forwarding the message of the session through the third interface and forwarding the message of the session through the fourth interface. Similarly, the client A can send the session message to the client B through the first network, and after the sent message of the session is forwarded to the first switch, the first switch will receive the message Forwarding to the first firewall and the second firewall, for example, forwarding the packet of the session through the first interface and forwarding the packet of the session through the second interface.

Step S206: the first firewall receives and forwards the packet of the session to the first switch.

Specifically, the first firewall receives the message forwarded by the second switch. In an optional solution, the first firewall determines whether the message contains the session entry after learning that it is the active firewall. If the five-tuple in is contained, the packet is forwarded to the first switch. In yet another optional solution, the first firewall does not need to confirm whether it is the active firewall or the standby firewall, but directly determines whether the received packet contains the quintuple in the above session entry, and if it contains Then forward the packet to the first switch.

When the above-mentioned second switch sends the same message to the second firewall as the message sent to the first firewall, in an optional solution, when the second firewall knows that it is a standby firewall, it discards the received message. In yet another optional solution, the second firewall receives the message sent by the second switch without confirming whether it is the active firewall or the standby firewall, and directly judges whether the message is in the message. Whether to include the five-tuple information in the established session table, and if yes, forward the received message to the first switch.

Step S207: the first switch receives the packet sent by the first firewall.

Step S208: the first switch forwards the packet sent by the first firewall to the first network.

Specifically, after receiving the packet sent by the first firewall, the first switch forwards the received packet to the first network. It should be noted that when the above-mentioned second firewall forwards the packet of the above-mentioned session to the first switch, the first switch does not receive the packet sent by the second firewall, or the first switch receives the packet sent by the second firewall. packets, but discard the packets sent by the second firewall. For example, the first switch can set the first interface connected to the first firewall as the main interface, and set the second interface connected to the second firewall as the main interface. For the backup interface, the first switch receives packets through the first interface and the second interface, but discards the packets received through the backup interface, or the first switch does not receive packets through the second interface as the backup interface at all. message.

By executing steps S201-208, the first firewall and the second firewall establish a session entry of the same session according to the same first message, and forward the message of the session when the first firewall is not faulty, and when the first firewall In case of a failure, there is no need to back up the session entry to the second firewall, and the above session entry established by the second firewall itself can be used to forward packets of the session.

In the following, steps S209-S212 describe an implementation manner in which the second firewall acts as the new active firewall to take over the forwarding of the message after the master-standby switchover occurs.

Step S209: the second switch sends the packet of the session to the second firewall.

Specifically, the second switch may detect whether the first firewall is faulty in real time or periodically; other devices may also detect whether the first firewall is faulty, and then notify the second switch of the detection result. The manner in which the second switch detects whether the first firewall is faulty may specifically be: detecting the link connected to the first firewall through a bidirectional forwarding detection (Bidirectional Forwarding Detection, BFD) mechanism, or the software of the device where the first firewall is located , or whether the network card of the device where the first firewall is located is faulty; or judge whether the time for not receiving the message sent by the first firewall exceeds a preset time threshold, and exceeding the time threshold indicates a failure. Of course, other methods may also be used to detect whether the first firewall is faulty, and other methods are not listed here.

When detecting that the first firewall fails or the link between the first switch and the first firewall is interrupted, the second switch uses the second firewall as the active firewall, and if the second switch receives A packet from the second network, in an optional solution, the second switch sends the packet to the second firewall instead of sending the packet to the first firewall, for example, the second switch The fourth interface is set as the new main interface, the third interface is set as the standby interface, and then the message is sent through the fourth interface as the new main interface, and the message is not sent through the third interface as the standby interface. In yet another optional solution, after the second switch resets the primary interface and the standby interface, it sends the message to both the first firewall and the second firewall. In yet another optional solution, the second switch sends the message to the second firewall, and after detecting that the first firewall fails or the link between the first switch and the first firewall is interrupted, Whether it is back to normal, if it is back to normal, when the second switch receives a message from the second network next time, it will send the received message to the first firewall and the second firewall. Other alternatives are not listed here one by one.

Step S210: the second firewall receives and forwards the packet of the session to the first switch.

Specifically, the second firewall receives the message sent by the second switch and judges whether there is a first message in the received message; when the message received by the second firewall contains the first message, the second firewall In addition to establishing a session based on the first packet, in an optional solution, the second firewall will also determine whether it is a standby firewall or an active firewall. If it is an active firewall, the second firewall will use the first packet Forwarding to the first switch, because the first firewall has failed, so the second firewall has been configured as the active firewall, so the second firewall will forward the first packet to the first switch. In yet another optional solution, the second firewall does not judge whether it is an active firewall or a standby firewall, but directly forwards the received first packet to the first switch.

Further, when the second firewall receives a data packet other than the first packet in the packet sent by the second switch, the second firewall judges whether the data packet is the session If the data packet is a packet of the session corresponding to the entry, in an optional solution, the second firewall forwards the data packet to the The first switch; in yet another optional solution, the second firewall omits confirming itself as the active firewall or the backup firewall, but directly forwards the received data packet to the first switch.

It should be noted that, when the first firewall also receives the message sent by the second switch, and the message contains the first message, the first firewall establishes a session based on the first message, in a In an optional solution, the first firewall will also judge whether it is a backup firewall or an active firewall. If it is a backup firewall, the first firewall will discard the first packet after receiving the first packet and establishing a session based on the first packet. first message. Since the first firewall is detected to be faulty in step S209, the first firewall is configured as a standby firewall and is no longer the active firewall, so the first firewall discards the first packet. In yet another optional solution, the first firewall omits judging whether it is the active firewall or the standby firewall, but directly forwards the received first packet to the first switch.

Further, when the first firewall receives a data packet other than the first packet in the packet sent by the second switch, the first firewall judges whether the data packet is the session entry according to the established session entry. Item corresponding to the message of the session, if the data message is the message of the session, in an optional solution, after the first firewall learns that it is a backup firewall, the data message is discarded; In an optional solution, the first firewall skips judging whether it is the active firewall or the standby firewall, and directly forwards the received data packet to the first switch.

Step S211: the first switch receives the packet sent by the second firewall.

Step S212: the first switch forwards the message sent by the second firewall to the first network.

Specifically, the first switch may detect whether the first firewall is faulty in real time or periodically; other devices may also detect whether the first firewall is faulty, and then notify the first switch of the detection result. The way for the first switch to detect whether the first firewall is faulty may specifically be: detecting the link connected to the first firewall through the BFD mechanism, or the software of the device where the first firewall is located, or the device where the first firewall is located Whether the network card of the first firewall is faulty; or judge whether the time for not receiving the message sent by the first firewall exceeds a preset time threshold, and exceeding the time threshold indicates a fault. Of course, other methods may also be used to detect whether the first firewall is faulty, and other methods are not listed here.

If the first switch does not receive the message sent by the second firewall when the first firewall is not faulty and the link between the first firewall and the first switch is not interrupted, then when the first firewall fault is detected, Or when the link is interrupted, the second firewall is used as the active firewall, and receives the message sent by the second firewall and forwards the message to the first network.

If the first switch receives and discards the packet sent by the second firewall when the first firewall is not faulty and the link between the first firewall and the first switch is not interrupted, then when the first firewall is detected When a fault occurs or the link is interrupted, the second firewall is used as the active firewall, and the message sent by the second firewall is no longer discarded but forwarded to the first network.

For example, the first switch sets the second interface as the new main interface, and sets the first interface as the standby interface, the first switch can receive packets through the second interface as the new main interface, and will pass through the second interface The received message is forwarded to the first network.

In the method described in FIG. 2, the first switch sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message In this way, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly replace the session entry on the first firewall based on the session entry established by itself. business, avoiding business interruption.

The method in the embodiment of the present invention has been described in detail above. In order to facilitate better implementation of the above solutions in the embodiment of the present invention, correspondingly, the switch in the embodiment of the present invention is provided below.

Please refer to FIG. 5. FIG. 5 is a first switch 50 provided by an embodiment of the present invention. The first switch 50 includes a processor 501, a memory 502, and a network interface 503. The processor 501, memory 502, and network interface 503 connected to each other via a bus.

Memory 502 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), or portable read-only memory (CD-ROM).

The processor 501 may be one or more central processing units (Central Processing Unit, CPU for short). In the case where the processor 501 is a CPU, the CPU may be a single-core CPU or a multi-core CPU.

The network interface 503 may be a wired interface, such as a Fiber Distributed Data Interface (FDDI for short) or a Gigabit Ethernet (GE for short); the network interface 503 may also be a wireless interface.

The memory 502 is also used to store information such as session entries, related instructions, and data.

The processor 501 in the first switch 50 is configured to perform the following operations after reading the program code stored in the memory 502:

A plurality of messages from the first network are received through the network interface 503, the first switch 50 is connected to the first firewall, the second firewall and the first network, and the plurality of messages are the first network For messages transmitted between a network and a second network, the first firewall is the active firewall, the second firewall is the standby firewall, the first firewall and the second firewall are connected to the first switch 50 and the second firewall respectively. connected to a second switch, the second switch is also connected to the second network;

Send the multiple packets to the first firewall and the second firewall respectively through the network interface 503, and the packets sent to the first firewall and the second firewall through the network interface 503 are The same, so that both the first firewall and the second firewall establish the session entry of the session to which the session header packet belongs according to the session header packet in the plurality of packets, and the session entry includes A quintuple, the quintuple is used to determine whether the message flowing through the firewall belongs to the session;

receiving the session packet from the second network sent by the first firewall through the network interface 503;

Forward the packet of the session from the second network to the first network through the network interface 503 .

By performing the above operations, the first switch 50 sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that Therefore, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the services on the first firewall based on the session entry established by itself. Business interruption is avoided.

In an optional solution, after the processor 501 respectively sends the multiple packets to the first firewall and the second firewall through the network interface 503, the processor 501 is further configured to: :

Detecting whether the first firewall fails, or whether the link between the first switch 50 and the first firewall is interrupted;

If the first firewall fails, or the link between the first switch 50 and the first firewall is interrupted, the network interface 503 receives and forwards the data sent by the second firewall from the first firewall. The packets of the session of the two networks.

In yet another optional solution, the processor 501 detects whether the first firewall fails, specifically: detecting whether the first firewall fails through a bidirectional forwarding detection mechanism BFD.

Specifically, the switch itself detects whether the first firewall is faulty, so as to adjust the packet forwarding policy in time when the first firewall is detected to be faulty, thereby improving the performance of the switch.

In yet another optional solution, before the processor 501 detects that the first firewall fails, or the link between the first switch 50 and the first firewall is interrupted, the processor 501 Also used for:

Not receiving the session packet from the second network sent by the second firewall, or receiving the session from the second network sent by the second firewall through the network interface 503 and discarding the packets sent by the second firewall from the session on the second network.

In yet another optional solution, the network interface 503 includes a first interface connecting the first switch 50 to the first firewall, and a first interface connecting the first switch 50 to the second firewall. two interfaces,

Before the processor 501 detects that the first firewall fails, or the link between the first switch 50 and the first firewall is interrupted, the first interface is set as the main interface, and the second The interface is set as a standby interface; the first switch 50 receives and forwards the message from the session of the second network sent by the first firewall through the first interface, and the first switch 50 Not receiving the session packet from the second network sent by the second firewall, or receiving the session from the second network sent by the second firewall through the second interface and discarding packets received through the second interface from the session of the second network;

After the processor 501 detects that the first firewall is faulty or the link between the first switch 50 and the first firewall is interrupted, it sets the first interface as a standby interface, and sets the second The second interface is set as the main interface, and receives and forwards the message of the session from the second network sent by the second firewall through the second interface.

It should be noted that, for the specific implementation of the switch 50, reference may also be made to the corresponding description of the method embodiment shown in FIG. 2 , which will not be repeated here.

By performing the above operations, the first switch 50 sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that Therefore, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the services on the first firewall based on the session entry established by itself. Business interruption is avoided.

Please refer to FIG. 6. FIG. 6 is a schematic structural diagram of another first switch 60 provided by an embodiment of the present invention. The first switch 60 may include a receiving unit 601 and a sending unit 602. Detailed descriptions of the receiving unit 601 and the sending unit 602 as follows.

The receiving unit 601 is configured to receive multiple packets from the first network, the first switch 60 is connected to the first firewall, the second firewall, and the first network, and the multiple packets are the first For messages transmitted between the network and the second network, the first firewall is the active firewall, the second firewall is the backup firewall, and the first firewall and the second firewall are connected to the first switch 60 and the second firewall respectively. Two switches are connected, and the second switch is also connected to the second network;

The sending unit 602 is configured to send the plurality of packets to the first firewall and the second firewall respectively, and the packets sent by the first switch 60 to the first firewall and the second firewall are the same so that both the first firewall and the second firewall establish a session entry for the session to which the session header packet belongs according to the session header packets in the plurality of packets, and the session entry includes five A tuple, the five-tuple is used to determine whether the message flowing through the firewall belongs to the session;

The receiving unit 601 is further configured to receive the packet sent by the first firewall from the session of the second network;

The sending unit 602 is further configured to forward the packet of the session from the second network to the first network.

By running the above units, the first switch 60 sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that Therefore, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the services on the first firewall based on the session entry established by itself. Business interruption is avoided.

In an optional solution, the first switch 60 further includes a detection unit, the detection unit is configured to send the plurality of packets to the first firewall and the second firewall respectively after the sending unit 602 , detecting whether the first firewall fails, or whether the link between the first switch 60 and the first firewall is interrupted;

If the first switch 60 detects that the first firewall fails, or the link between the first switch 60 and the first firewall is interrupted, the receiving unit 601 is further configured to receive the The packet of the session from the second network, the sending unit 602 is further configured to forward the packet of the session from the second network sent by the second firewall.

In yet another optional solution, the detection unit is specifically configured to detect whether the first firewall is faulty through a bidirectional forwarding detection mechanism BFD.

Specifically, the switch itself detects whether the first firewall is faulty, so as to adjust the packet forwarding policy in time when the first firewall is detected to be faulty, thereby improving the performance of the switch.

In yet another optional solution, the first switch 60 further includes a discarding unit, and when the detection unit detects a failure of the first firewall, or between the first switch 60 and the first firewall Before the link of the network is interrupted, the receiving unit 601 is further configured not to receive the packet sent by the second firewall from the session of the second network, or the receiving unit 601 is configured to receive the packet sent by the second firewall. The packet from the session of the second network, the discarding unit is configured to discard the packet received by the receiving unit 601 and sent by the second firewall from the session of the second network.

In yet another optional solution, the first switch 60 includes a first interface through which the first switch 60 is connected to the first firewall, and an interface through which the first switch 60 is connected to the second firewall. the second interface,

Before the detection unit detects that the first firewall is faulty, or the link between the first switch 60 and the first firewall is interrupted, the first interface is set as the main interface, and the second interface is set as For the backup interface; the receiving unit 601 of the first switch 60 receives through the first interface the packet sent by the first firewall from the session of the second network, and the sending unit 602 forwards the message sent by the receiving unit 601 through the The receiving unit 601 of the first switch 60 does not receive the packet sent by the second firewall and sent by the second firewall from the session of the second network received by the first interface. The message of the session of the network, or the receiving unit 601 receives the message of the session from the second network sent by the second firewall through the standby interface, and the discarding unit discards the message sent by the receiving unit 601 through the The packet received by the standby interface from the session of the second network;

The first switch 60 also includes a configuration unit, configured to configure the The first interface is set as a backup interface, the second interface is set as a main interface, and the receiving unit 601 is further configured to receive the second interface through the second interface after the configuration unit sets the second interface as the main interface. The second firewall sends the message from the session of the second network, and the sending unit 602 is further configured to forward the message received by the receiving unit 601 through the second interface and sent by the second firewall from the second network. A report of the session of the two networks.

It should be noted that, for the specific implementation of the switch 60, reference may also be made to the corresponding description of the method embodiment shown in FIG. 2 , which will not be repeated here.

By running the above units, the first switch 60 sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same session entry according to the first message in the message, so that Therefore, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly take over the services on the first firewall based on the session entry established by itself. Business interruption is avoided.

The method and the switch of the embodiment of the present invention have been described in detail above. In order to better implement the above solution of the embodiment of the present invention, correspondingly, the system of the embodiment of the present invention is provided below.

Please refer to FIG. 7. FIG. 7 is a message forwarding system 70 provided by an embodiment of the present invention. The file forwarding system 70 includes a first switch 701, a second switch 702, a first firewall 703, and a second firewall 704, wherein, The first switch 701 is connected to the first firewall 703, the second firewall 704 and the first network, the first firewall 703 is the active firewall, the second firewall 704 is the backup firewall, the first firewall 703 and the second firewall 704 are respectively connected to the first switch 701 and the second switch 702, and the second switch 702 is also connected to the second network, wherein:

The first switch 701 is configured to receive multiple packets from the first network, the multiple packets are packets transmitted between the first network and the second network; Sending the multiple packets with the second firewall 704, the packets sent by the first switch 701 to the first firewall 703 and the second firewall 704 are the same;

The first firewall 703 and the second firewall 704 are respectively configured to establish a session table of the session to which the session header message belongs according to the session header message in the plurality of messages sent by the first switch 701 item, the session entry includes a five-tuple, and the five-tuple is used to determine whether the message flowing through the firewall belongs to the session;

The first firewall 703 is further configured to forward the packet of the session from the second network to the first switch 701;

The first switch 701 is further configured to receive the packet of the session from the second network sent by the first firewall 703;

The first switch 701 is further configured to forward the packet of the session from the second network to the first network.

By running the message forwarding system 70, the first switch 701 sends the same message to the first firewall 703 and the second firewall 704, so that the first firewall 703 and the second firewall 704 establish The same session entry, so that the second firewall 704 does not need to back up the session entry from the first firewall 703. When the first firewall 703 fails, the second firewall 704 can directly establish The session entry takes over the service on the first firewall 703, avoiding service interruption.

In an alternative,

The first switch 701 includes a first interface connecting the first switch 701 to the first firewall 703, and a second interface connecting the first switch 701 to the second firewall 704, the second The firewall 704 is further configured to forward the packet of the session from the second network to the first switch 701;

The first switch 701 is configured to detect whether the first firewall 703 fails, or whether the link between the first switch 701 and the first firewall 703 is interrupted, and detects that the first firewall 703 failure, or before the link between the first switch 701 and the first firewall 703 is interrupted, the first interface is set as the main interface, and the second interface is set as the standby interface; After the first firewall 703 fails, or the link between the first switch 701 and the first firewall 703 is interrupted, the first interface is set as a standby interface, and the second interface is set as a main interface;

Before the failure of the first firewall 703 is detected, or the link between the first switch 701 and the first firewall 703 is interrupted, the first interface and the second interface respectively receive the first A firewall 703 and the second firewall 704 send the message from the session of the second network, and discard the message received through the second interface from the session of the second network arts;

After detecting that the first firewall 703 is faulty or the link between the first switch 701 and the first firewall 703 is interrupted, the second interface respectively receives the data sent by the second firewall 704 from the packet of the session on the second network, and forward the packet of the session from the second network received through the second interface to the first network.

In yet another optional solution, the second firewall 704 is also used to detect whether the second firewall 704 is a backup firewall, and if the second firewall 704 is a backup firewall, forwarding to the first switch 701 is prohibited. The packet from the session on the second network is prohibited from forwarding the packet from the session on the first network to the second switch 702 .

Further, the specific implementation of the first switch 701 can also correspond to the implementation of the first switch 50 in the embodiment shown in FIG. 5 and the first switch 60 in the embodiment shown in FIG. 6; the specific implementation of the second switch 702 can also It can be implemented correspondingly with reference to the second switch in the embodiment shown in Figure 5 and Figure 6; the specific implementation of the first firewall 703 can also be implemented with reference to the first firewall in the embodiment shown in Figure 5 and Figure 6; the second firewall 704 The specific implementation may also correspond to the implementation of the second firewall in the embodiment shown in FIG. 5 and FIG. 6 .

By running the message forwarding system 70, the first switch 701 sends the same message to the first firewall 703 and the second firewall 704, so that the first firewall 703 and the second firewall 704 establish The same session entry, so that the second firewall 704 does not need to back up the session entry from the first firewall 703. When the first firewall 703 fails, the second firewall 704 can directly establish The session entry takes over the service on the first firewall 703, avoiding service interruption.

To sum up, by implementing the embodiment of the present invention, the first switch sends the same message to the first firewall and the second firewall, so that the first firewall and the second firewall establish the same message according to the first message in the message. In this way, the second firewall does not need to back up the session entry from the first firewall. When the first firewall fails, the second firewall can directly replace the first firewall based on the session entry established by itself. A service on the firewall avoids service interruption.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented through computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. During execution, it may include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes various media capable of storing program codes such as ROM, RAM, magnetic disk or optical disk.

The above embodiments only disclose the preferred embodiments of the present invention, and cannot limit the scope of rights of the present invention with this. Those of ordinary skill in the art can understand the whole or part of the process of realizing the above embodiments, and make according to the claims of the present invention Equivalent changes still belong to the scope covered by the invention.

Claims (13)

1. a kind of message forwarding method, it is characterised in that including：

First interchanger receives the multiple messages for coming from first network, first interchanger and the first fire prevention Wall, the second fire wall are connected with the first network, and the multiple message is the first network and the second net The message transmitted between network, first fire wall is master firewall, and second fire wall is standby anti- Wall with flues, first fire wall and the second fire wall are connected with first interchanger and second switch respectively, The second switch also with second network connection；

First interchanger sends the multiple report to first fire wall and second fire wall respectively Text, the message that first interchanger is sent to first fire wall and second fire wall is identical, So that first fire wall and second fire wall are built all in accordance with the session first message in the multiple message The session entry of the affiliated session of session first message is found, the session entry includes five-tuple, described five yuan Whether the message that group is used to judge to flow through fire wall belongs to the session；

First interchanger receives the meeting for coming from second network that first fire wall is sent The message of words；

Come from the session of second network described in first interchanger to first network forwarding Message.

2. according to the method described in claim 1, it is characterised in that first interchanger is respectively to described First fire wall and second fire wall are sent after the multiple message, and methods described also includes：

Whether the first fire wall described in the first exchange machine testing breaks down, or first interchanger Whether the link between first fire wall interrupts；

If first interchanger detect the first fire wall failure or first interchanger with Link down between first fire wall, then first interchanger receive and forward it is described second fire prevention The message for the session for coming from second network that wall is sent.

3. method according to claim 2, it is characterised in that described first exchanges described in machine testing the Whether one fire wall breaks down, and is specially：

First interchanger by two-way converting testing mechanism BFD detect first fire wall whether failure.

4. according to the method in claim 2 or 3, it is characterised in that first interchanger is detected Link down between the first fire wall failure or first interchanger and first fire wall Before, methods described also includes：

What first interchanger did not received that second fire wall sends comes from the described of second network The message of session, or receive and abandon the institute for coming from second network that second fire wall is sent State the message of session.

5. method according to claim 4, it is characterised in that first interchanger includes described the The first interface that one interchanger is connected with first fire wall, and first interchanger and described second The connected second interface of fire wall,

First interchanger detect the first fire wall failure or first interchanger with it is described Before link down between first fire wall, the first interface is arranged to main interface, and described second connects Mouth is arranged to standby interface；First interchanger is received by the first interface and forwards described first to prevent The message for the session for coming from second network that wall with flues is sent, first interchanger does not receive institute The message of the session for coming from second network of the second fire wall transmission is stated, or by described standby The message for the session for coming from second network that second fire wall described in interface is sent, and lose Abandon by the standby interface to the session for coming from second network message；

First interchanger detect the first fire wall failure or first interchanger with it is described After link down between first fire wall, methods described also includes：

The first interface is set to standby interface, the second interface main interface is set to, by described Second interface receives and forwarded the session for coming from second network of the second fire wall transmission Message.

6. a kind of first interchanger, it is characterised in that first interchanger include processor, memory and Network interface, wherein：

The network interface is used to receive message and sends message；

The memory is used for store instruction and data；

The processor, for reading the instruction and data stored in the memory, performs following operation：

Received by the network interface and come from multiple messages of first network, first interchanger and the One fire wall, the second fire wall are connected with the first network, the multiple message be the first network with The message transmitted between second network, first fire wall is master firewall, and second fire wall is Slave firewall, first fire wall and the second fire wall are exchanged with first interchanger and second respectively Machine connect, the second switch also with second network connection；

Send the multiple to first fire wall and second fire wall respectively by the network interface Message, the message sent by the network interface to first fire wall and second fire wall is phase With, so that first fire wall and second fire wall are first all in accordance with the session in the multiple message Message sets up the session entry of the affiliated session of session first message, and the session entry includes five-tuple, institute State five-tuple be used for judge flow through the message of fire wall and whether belong to the session；

Come from by what network interface reception first fire wall was sent described in second network The message of session；

By the meeting for coming from second network described in the network interface to first network forwarding The message of words.

7. the first interchanger according to claim 6, it is characterised in that the processor passes through described After network interface sends the multiple message to first fire wall and second fire wall respectively, institute Processor is stated to be additionally operable to：

Detect whether first fire wall breaks down, or first interchanger and the described first fire prevention Whether the link between wall interrupts；

If between the first fire wall failure or first interchanger and first fire wall Link down, then received by the network interface and forward coming from for the second fire wall transmission described The message of the session of second network.

8. the first interchanger according to claim 7, it is characterised in that the processor detection is described Whether the first fire wall breaks down, and is specially：

By two-way converting testing mechanism BFD detect first fire wall whether failure.

9. the first interchanger according to claim 7 or 8, it is characterised in that the processor detection Into the link between the first fire wall failure or first interchanger and first fire wall Before disconnected, the processor is additionally operable to：

The message for the session for coming from second network that second fire wall is sent is not received, or Person receives the meeting for coming from second network that second fire wall is sent by the network interface The message of words, and abandon the report for the session for coming from second network that second fire wall is sent Text.

10. the first interchanger according to claim 9, it is characterised in that the network interface includes The first interface that first interchanger is connected with first fire wall, and first interchanger and institute The connected second interface of the second fire wall is stated,

The processor detects the first fire wall failure or first interchanger and described first Before link down between fire wall, the first interface is arranged to main interface, the second interface quilt It is set to standby interface；First interchanger is received by the first interface and forwards first fire wall The message of the session for coming from second network sent, first interchanger does not receive described the The message for the session for coming from second network that two fire walls are sent, or connect by described second Mouth receives the message for the session for coming from second network that second fire wall is sent, and abandons The message of the session for coming from second network received by the second interface；

The processor detects the first fire wall failure or first interchanger and described first After link down between fire wall, the first interface is set to standby interface, by the second interface Main interface is set to, is received by the second interface and forwards what second fire wall sent to come from institute State the message of the session of the second network.

11. a kind of message forwarding system, it is characterised in that the system includes the first interchanger, the second friendship Change planes, the first fire wall and the second fire wall；Wherein, first interchanger and the first fire wall, second Fire wall is connected with the first network, and first fire wall is master firewall, second fire wall For slave firewall, first fire wall and the second fire wall are handed over first interchanger and second respectively Change planes connection, the second switch also with second network connection, wherein：

First interchanger, multiple messages of first network is come from for receiving, the multiple message is described The message transmitted between first network and the second network；Respectively to first fire wall and second fire prevention Wall sends the multiple message, and first interchanger is sent out to first fire wall and second fire wall The message sent is identical；

First fire wall and second fire wall, are respectively used to what is sent according to first interchanger Session first message in the multiple message sets up the session entry of the affiliated session of session first message, described Session entry includes five-tuple, and whether the message that the five-tuple is used to judge to flow through fire wall belongs to the meeting Words；

First fire wall, is additionally operable to first interchanger forwarding from described in second network The message of session；

First interchanger, be additionally operable to reception the first fire wall transmission comes from second network The session message；

First interchanger, be additionally operable to the first network forwarding described in come from second network The message of the session.

12. system according to claim 11, it is characterised in that first interchanger includes described The first interface that first interchanger is connected with first fire wall, and first interchanger and described the The connected second interface of two fire walls, second fire wall is additionally operable to come to first interchanger forwarding From the message of the session of second network；

First interchanger, for detect first fire wall whether failure or it is described first exchange Whether the link between machine and first fire wall interrupts, and detect the first fire wall failure, Or set the first interface before the link down between first interchanger and first fire wall Main interface is set to, the second interface is set to standby interface；Detect the first fire wall failure, Or set the first interface after the link down between first interchanger and first fire wall Standby interface is set to, the second interface is set to main interface；

Detect the first fire wall failure or first interchanger and first fire wall it Between link down before, by the first interface and the second interface receive respectively it is described first fire prevention The message for the session for coming from second network that wall and second fire wall are sent, and abandon logical Cross the message for the session from second network that the second interface is received；

Detect the first fire wall failure or first interchanger and first fire wall it Between link down after, pass through coming from that the second interface receives that second fire wall sends respectively The message of the session of second network, and connect to first network forwarding by the second interface What is received comes from the message of the session of second network.

13. method according to claim 11, it is characterised in that：

Second fire wall, is additionally operable to whether detection second fire wall is slave firewall, if second Fire wall is slave firewall, then forbids to first interchanger forwarding from described in second network The message of session, forbids forwarding the message of the session from the first network to the second switch.