JP5219967B2 - Internetwork equipment - Google Patents

Description

  The present invention relates to an internetwork apparatus that mutually converts a local address used in a specific network and a global address used across a plurality of networks.

  Communication between a global network that uses a global address and connects multiple networks (hereinafter referred to as “Internet” as a representative example) and a local network that uses a local address is at the boundary between the local network and the Internet. This is realized by performing address conversion between the local address and the global address in the arranged router. Such address translation is called “Network Address Translation”. Also, for effective use of limited global addresses, conversion using the TCP / UDP communication port number in addition to the local address and global address (referred to as “address / port conversion”, “Network Address and Port Translation”) ) Is also generally used (see, for example, Patent Document 1). In this specification, “address translation (hereinafter also referred to as“ NAT ”)” means “address / port translation”. Conventionally, address translation has been used in a router or the like for connecting a small domestic / in-house local network and the Internet.

  Such a router having a NAT function that is used by corporate users and individual users to connect to an ISP is rarely used in a redundant configuration. Further, even in a redundant configuration, it is not used in a configuration in which two redundant routers are operated simultaneously (also referred to as “Double ACT configuration”), and one (main system) is operated and the other ( In many cases, the standby system is used in a configuration (also referred to as a “Cold_Standby configuration”) that is in a standby state without being operated.

JP-A-11-150566

  By the way, due to the lack of global addresses in IPv4 in recent years, for example, even Internet service providers with a large number of users (hereinafter also referred to as “ISP”) want to allocate users by assigning local addresses to routers in their own networks. And needs are growing. In this case, the NAT function is also required at the connection point (carrier edge) between the ISP and the Internet. The NAT at this position is significantly different from the NAT used by enterprise users and individual users to connect to the ISP, and the “Large Scale NAT (abbreviated as LSN)” or “Carrier Grad NAT (abbreviated as“ abbreviated ”). CGN) ”. The router having the LSN function is required to have so-called carrier performance and reliability. Hereinafter, a router having an LSN function is also referred to as an “internetwork device”.

  Since an internetwork device is often required to have higher reliability than a router having a conventional NAT function, the internetwork device is configured to operate two redundant internetwork devices simultaneously (also referred to as a “double ACT configuration”). An LSN may be executed. When the LSN is executed by the double ACT configuration of the internetwork device, when the internetwork device is configured with the same configuration as the router having the NAT function that is used by the conventional corporate user or individual user to connect to the ISP, There is a possibility that transfer processing of connection-type packets (hereinafter referred to as “protocol packets”) such as TCP cannot be executed correctly.

  For example, if the load is randomly distributed between the upstream communication device and the downstream communication device of the internetwork device, the protocol packet transfer path is not uniquely determined, and the outbound transfer and the inbound transfer are routed through different internetwork devices. there's a possibility that. If the outbound transfer and the inbound transfer pass through different internetwork devices, the internetwork device cannot correctly grasp the sequence state of the protocol packet.

  Such a problem is not limited to two internetwork devices, but is a common issue when performing address translation in a configuration in which a plurality of internetwork devices are operated simultaneously.

  The present invention has been made to solve the above problems, and provides a technique for managing the sequence state of protocol packets when address translation is performed in a configuration in which a plurality of internetwork devices are operated simultaneously. With the goal.

  In order to solve at least a part of the above problems, the present invention can be realized as the following forms or application examples.

[Application Example 1] An internetwork device,
A receiving unit for receiving packets from the first network;
For at least one of the source address and destination address of a packet, a local address used in a specific network and a global address used between a plurality of networks are mutually converted, and addresses before and after the address conversion are converted. An address translation unit for transferring the address translation information including the address translation information to another internetwork device;
A transmitter that transmits the address-converted packet to the second network;
The second network is advertised as a route with the global address of the internetwork device as the first priority, and the route advertisement is advertised with the global network address of the other internetwork device as the second priority. , The route controller,
An internetwork device comprising:

  In this internetwork device, by performing route advertisement with the global address of the internetwork device as the first priority, even in the redundant configuration of double ACT, the protocol packet transfer route is uniquely determined, and the sequence state of the protocol packet is determined. It is possible to grasp correctly. In addition, route advertisement is performed with the global network address of another internetwork device as second priority, and address translation information including addresses before and after address translation is transferred to the other internetwork device. Even if a failure occurs in the internetwork apparatus, the packet transfer can be continued through another internetwork apparatus, and the reliability of the packet transfer can be improved.

[Application Example 2] The internetwork device according to Application Example 1,
The receiving unit is a first receiving unit;
further,
A second receiver for receiving packets from the second network;
The route control unit
An internetwork apparatus that transfers the packet to the address translation unit when the packet received by the second reception unit is a protocol packet.

  In this internetwork apparatus, since the protocol packet transferred from the second network to the first network is transferred to the address conversion unit, the address conversion created at the time of packet transfer from the first network to the second network By using the information and the information on the sequence state, it is possible to appropriately perform the address translation of the protocol packet and the management of the sequence state.

[Application Example 3] The internetwork device according to Application Example 1 or 2,
The address conversion unit mutually converts the local address and the global address for at least one of a combination of a source address and a communication port number and a combination of a destination address and a communication port number, and the address conversion The information further includes an internetwork device including the communication port numbers before and after the address conversion.

  In this internetwork device, when address / port conversion is executed in a configuration in which a plurality of internetwork devices are operated simultaneously, processing for a protocol packet can be correctly executed.

[Application Example 4] The internetwork device according to any one of Application Examples 1 to 3,
further,
An inter-device packet transfer interface for performing inter-device packet transfer, which is packet transfer with the other internetwork device;
An inter-device packet transfer control unit for causing the received packet to be transferred to the inter-device packet interface based on a load on the internetwork device and the other internetwork device;
An internetwork device comprising:

  In this internetwork device, it is possible to realize load adjustment between the internetwork device and another internetwork device.

  Note that the present invention can be realized in various modes, for example, an internetwork device, an address conversion method, a network system including a plurality of internetwork devices, and the functions of these devices, methods, and systems. For example, an integrated circuit, a computer program, a recording medium on which the computer program is recorded, and the like.

It is explanatory drawing which shows roughly the structure of the network 10 in the Example of this invention. 2 is an explanatory diagram schematically showing a configuration of an internetwork apparatus 100. FIG. It is explanatory drawing which shows the route advertisement performed in the internetwork apparatus 100. FIG. It is explanatory drawing which shows the protocol packet transfer path | route in a present Example. It is explanatory drawing which shows the protocol packet transfer path | route when the internetwork apparatus 100A fails. It is a flowchart which shows the flow of an outbound packet transfer process. It is explanatory drawing which shows the transfer path | route of the packet in an outbound packet transfer process. It is a flowchart which shows the flow of the transfer packet transfer process between apparatuses. It is a flowchart which shows the flow of an inbound packet transfer process. It is explanatory drawing which shows the transfer path | route of the packet in an inbound packet transfer process.

Next, embodiments of the present invention will be described in the following order based on examples.
A. Example:
A-1. System and equipment configuration:
A-2. Protocol packet transfer route:
A-3. Outbound packet transfer processing:
A-4. Inter-device transfer outbound packet transfer processing:
A-5. Inbound packet transfer processing:
A-6. Effects of the embodiment:
B. Variations:

A. Example:
A-1. System and equipment configuration:
FIG. 1 is an explanatory diagram schematically showing the configuration of a network 10 in an embodiment of the present invention. This embodiment will be described using a network 10 including three ISPs (Internet Service Providers) 200. Each ISP 200 accommodates an individual user 220 via a home router 210 having a NAT function, and accommodates an enterprise user 250 via an enterprise network (intra-company network) 240 and an enterprise router 230 having a NAT function.

  The ISP-A (200A) is an ISP having a global address, and can communicate with the Internet 300 by being directly connected to the carrier edge router 310. The Internet 300 is provided with an HTTP server 320 at a location accessible from the individual user 220 and the corporate user 250 that are clients.

  ISP-B (200B) and ISP-C (200C) are ISPs having no global address, and are connected to the carrier edge router 310 via the internetwork apparatus 100 having an LSN (Large Scale NAT) function. The communication with the Internet 300 is possible. In this embodiment, a redundant configuration (Double ACT configuration) in which two internetwork devices 100 (internetwork device A (100A) and internetwork device B (100B)) having the same function and configuration are simultaneously operated is employed. ing. That is, each of ISP-B (200B) and ISP-C (200C) is connected to two internetwork apparatuses 100, and can be connected to carrier edge router 310 via any internetwork apparatus 100. .

  Further, the two internetwork apparatuses 100 synchronize information necessary for address translation (session information). Each of ISP-B (200B) and ISP-C (200C) has a router connected to two internetwork apparatuses 100. In these routers, packets from the ISP 200 (local network) to the Internet 300 (hereinafter also referred to as “outbound communication”) are distributed to one of the two internetwork devices 100.

  Similarly, in the carrier edge router 310, packets in communication from the Internet 300 to the ISP 200 (hereinafter also referred to as “inbound communication”) are distributed to one of the two internetwork apparatuses 100. Thereby, load distribution in the two internetwork apparatuses 100 is realized. If one of the two internetwork devices 100 fails, address translation can be continued by distributing all packets to the other internetwork device 100. It should be noted that the function of the internetwork device 100 can be considered as a part of the function of the carrier edge router 310.

  FIG. 2 is an explanatory diagram schematically showing the configuration of the internetwork apparatus 100. FIG. 2 shows the configuration of two internetwork apparatuses 100 (internetwork apparatus A (100A) and internetwork apparatus B (100B)). The two internetwork apparatuses 100 have different IP address ranges (hereinafter referred to as “NAT_Pool_Address”), but the other configurations are the same. In the following description, the two internetwork apparatuses 100 and When it is not necessary to distinguish the constituent elements from each other, it may be omitted to attach identifiers (“A” and “B”) that distinguish each other from names and codes. The internetwork apparatus 100A in this embodiment holds NAT_Pool_Address: α as an address group for address conversion, and the internetwork apparatus 100B holds NAT_Pool_Address: β.

  The internetwork device 100 is a device that performs communication between the local network LNET and the global network GNET by performing address translation (address / port translation). The internetwork apparatus 100 includes an inside packet interface (packet I / F (I)) 101, an outside packet interface (packet I / F (O)) 103, a path control unit 102, and an inside address conversion unit. (Address translation unit (I)) 104, outside address translation unit (address translation unit (O)) 105, inside redundant inter-device packet transfer interface (inter-device packet transfer I / F (I)) 106, It is equipped with.

  The inside-side packet interface 101 is an interface for connecting to the local network LNET, and is connected to the router that distributes the load disposed in the local network LNET and the path control unit 102. The inside-side packet interface 101 receives an outbound communication packet (hereinafter referred to as “outbound packet OBP”) P transmitted from the router arranged in the local network LNET, transfers the packet P to the route control unit 102, and The inbound communication packet transferred from the control unit 102 (hereinafter referred to as “inbound packet IBP”) is received and transferred to the router.

  The outside-side packet interface 103 is an interface for connecting to the global network GNET, and is connected to the carrier edge router 310 (FIG. 1) and the route control unit 102. The outside-side packet interface 103 receives the inbound packet IBP transmitted from the carrier edge router 310 and transfers it to the route control unit 102 and receives the outbound packet OBP transferred from the route control unit 102 to receive the inbound packet IBP. Forward to 310. The inside packet interface 101 and the outside packet interface 103 function as a transmission unit and a reception unit in the present invention.

  The route control unit 102 is connected to each component of the internetwork apparatus 100 and controls packet routing. The path control unit 102 performs a process for transferring a packet received via each interface and a process for determining whether or not the received packet is a protocol packet. Details of the packet transfer processing by the route control unit 102 will be described later.

  Further, the route control unit 102 has a function of performing route advertisement for an arbitrarily set IP address to the carrier edge router 310 (FIG. 1). The route advertisement is performed every predetermined period (for example, every 30 seconds). FIG. 3 is an explanatory diagram showing route advertisement performed in the internetwork apparatus 100. The internetwork device 100A performs route advertisement RA in which NAT_Pool_Address: α held by the own device is given first priority and NAT_Pool_Address: β held by the redundantly configured internetwork device 100B is given second priority. On the other hand, the internetwork device 100B performs route advertisement RB in which NAT_Pool_Address: β held by itself is given first priority and NAT_Pool_Address: α held by redundant internetwork device 100A is given second priority. The route advertisement can be performed using various well-known protocols such as RIP (Routing Information Protocol), OSPF (Open Shortest Path First), BGP (Border Gateway Protocol) and the like.

  Since the carrier edge router 310 has received the route advertisement RA, when the packet whose destination is NAT_Pool_Address: α is received from the server 370, the carrier edge router 310 transfers the packet to the internetwork apparatus 100A according to the first priority. However, when the carrier edge router 310 detects that a failure has occurred in the internetwork device 100A, when receiving a packet whose destination is NAT_Pool_Address: α from the server 370, the carrier edge router 310 sends the packet to the internetwork according to the second priority. Transfer to device 100B. Further, since the carrier edge router 310 has received the route advertisement RB, when the packet whose destination is NAT_Pool_Address: β is received from the server 370, the carrier edge router 310 transfers the packet to the internetwork apparatus 100B according to the first priority. However, when the carrier edge router 310 detects that a failure has occurred in the internetwork device 100B, when the packet whose destination is NAT_Pool_Address: β is received from the server 370, the carrier edge router 310 sends the packet to the internetwork according to the second priority. Transfer to apparatus 100A. As a method of detecting a failure in the internetwork device 100 in the carrier edge router 310, for example, the carrier edge router 310 receives a packet whose destination is NAT_Pool_Address: α from the server 370 and receives the packet from the internetwork device. When the packet is transferred to 100A, a method may be used in which it is determined that a failure has occurred in the internetwork apparatus 100A when a predetermined time has passed without a response packet to the packet being transferred.

  The inside redundant inter-device packet transfer interface 106 is an interface for transferring the outbound packet OBP to another internetwork device 100. During operation in the double ACT configuration, the inside redundant inter-device packet transfer interface 106A of the internetwork device 100A is connected to the inside redundant inter-device packet transfer interface 106B of the redundant configuration internetwork device 100B via the dedicated line 112. Is done.

  The inside redundant inter-device packet transfer interface 106 receives the outbound packet OBP transferred from the route control unit 102 in the own device, and transmits it to the inside redundant inter-device packet transfer interface 106 of another internetwork device 100. Then, an outbound packet OBP (also referred to as “inter-device transfer outbound packet TOBP”) transferred from another internetwork device 100 is received and transferred to the route control unit 102 in the own device.

  In this embodiment, between all the redundant devices for inside so that all the outbound packets OBP received by the inside packet interface 101 can be transferred to another internetwork device 100 as an inter-device transfer outbound packet TOBP. The communication band (line speed) of the packet transfer interface 106 is the same as the communication band (line speed) of the inside packet interface 101.

  The inside address conversion unit 104 holds address / port conversion information (session information), and converts the source address and communication port number of the outbound packet OBP transferred from the route control unit 102 based on the address / port conversion information. (Address conversion) is performed, and information regarding the sequence state of the protocol packet is registered. Then, the outbound packet OBP after the address translation is transferred to the route control unit 102 again. The information on the sequence state is information necessary for exchanging protocol packets, such as the transition from the “waiting state” to the “packet CH establishment response waiting state”. In this embodiment, the sequence state Registering the information on is also expressed as “holding a sequence state transition”. In addition, the destination address and communication port number of the protocol packet in the inbound packet IBP transferred from the route control unit 102 are converted (address conversion), and information related to the sequence state of the protocol packet is registered to perform address conversion. The subsequent inbound packet IBP is transferred to the route control unit 102 again.

  Specifically, the address / port conversion information includes an address conversion rule table indicating a correspondence relationship between a local address and a global address, a free port management table indicating a use / unused state of a communication port in the global address, An address / port conversion table showing a correspondence relationship between a combination of an address and a communication port on the local network side in a state where communication is actually performed and a combination of an address and a communication port on the global network side.

  The inside address conversion unit 104 extracts a global address corresponding to the transmission source local address extracted from the OBP packet transferred from the route control unit 102 from the address conversion rule table, and the communication extracted from the received outbound packet OBP. A communication port corresponding to the port is assigned from the free port management table, registered in the address / port conversion table, and address conversion in the packet in the subsequent communication is performed based on the address / port conversion table. Further, the inside address conversion unit 104 does not register the address / port conversion table when receiving the inbound packet IBP, but based on the address / port conversion table registered in the previous outbound communication, The destination global address is converted to a local address and the communication port is converted.

  The outside address translation unit 105 holds address / port translation information (session information) and, based on the address / port translation information, out-of-bound packet IBP transferred from the path control unit 102 includes packets that are not protocol packets. The destination address and communication port number are converted (address conversion), and the inbound packet IBP after the address conversion is transferred to the route control unit 102 again. In this embodiment, the packet that is not a protocol packet is a connectionless packet such as UDP.

  The inside address conversion unit 104A of the internetwork apparatus 100A holds the address conversion address group NAT_Pool_Address: α, and performs address conversion using the IP address registered in the address conversion address group. On the other hand, the inside address translation unit 104B of the internetwork apparatus 100B holds the address translation address group NAT_Pool_Address: β and performs address translation using the IP address registered in the address translation address group.

  The inside address conversion unit 104 and the outside address conversion unit 105 are connected to each other via a line 126 and are also connected to the inside address conversion unit 104 of another internetwork apparatus 100 via lines 122 and 124. And the outside address conversion unit 105. The inside address translation unit 104 updates the address / port translation information and the sequence status to the outside address translation unit 105 via the line 126 when the address / port translation information or the sequence status information held by the inside address translation unit 104 is updated. In addition to transferring the information, the address / port conversion information and the information regarding the sequence state are transferred to the inside address conversion unit 104 of the other internetwork apparatus 100 via the line 122. The outside address translation unit 105 also updates the outside address translation unit 105 of another internetwork apparatus 100 via the line 124 when the address / port translation information or sequence state information of the outside address translation unit 105 is updated. Address / port translation information and sequence state information. In the present embodiment, in this way, the state in which information is transferred between the address conversion units and the same information is held is expressed as “synchronize”. In the present embodiment, the synchronization of information in the inside address conversion unit 104A of the internetwork device 100A and the inside address conversion unit 104B of the internetwork device 100B is performed every time the information is updated. When a failure occurs in the device 100A and a packet to be transferred to the internetwork device 100A is transferred to the internetwork device 100B, the inside address conversion unit 104B performs the address conversion at a sufficient speed. .

A-2. Protocol packet transfer route:
FIG. 4 is an explanatory diagram showing a protocol packet transfer path in the present embodiment. As illustrated, the internetwork device 100 is connected to a local network router 260 in the local network LNET and to a carrier edge router 310 in the global network GNET. Personal user terminals 222 and 224 are connected to the local network router 260, and a server 370 is connected to the carrier edge router 310.

  The protocol packet output from the personal user terminal 222 to the server 370 is routed by the local network router 260 and transferred to the internetwork apparatus 100A. The protocol packet transferred to the internetwork apparatus 100A is converted into an IP address (global address) held in NAT_Pool_Address: α by the address translation function provided in the internetwork apparatus 100A, and the carrier edge router It is transferred to the server 370 via 310.

  The response packet of this protocol packet is output from the server 370 as an IP address whose destination address is held in NAT_Pool_Address: α. Upon receiving this response packet, the carrier edge router 310 transfers the response packet to the internetwork device 100A according to the first priority of the route advertisement RA (FIG. 3) performed by the internetwork device 100. In the internetwork device 100A, the destination address (global address) is converted into the IP address (local address) of the personal user terminal 222 and transferred to the personal user terminal 222 via the local network router 260 (the transfer route in FIG. 4). R1).

  On the other hand, the protocol packet output from the personal user terminal 224 to the server 370 is routed by the local network router 260 and transferred to the internetwork apparatus 100B. The protocol packet transferred to the internetwork device 100B is converted into an IP address (global address) held in NAT_Pool_Address: β by the address translation function provided in the internetwork device 100B, and the carrier edge router It is transferred to the server 370 via 310.

  The response packet of this protocol packet is output from the server 370 as an IP address (global address) whose transmission destination address is held in NAT_Pool_Address: β. Receiving this response packet, the carrier edge router 310 transfers the response packet to the internetwork device 100B according to the first priority of the route advertisement RB (FIG. 3) of the internetwork device 100B. In the internetwork apparatus 100B, the destination address (global address) is converted into the IP address (local address) of the personal user terminal 224, and transferred to the personal user terminal 224 via the local network router 260 (the transfer route in FIG. 4). R2).

  FIG. 5 is an explanatory diagram showing a protocol packet transfer path when the internetwork device 100A fails. When the internetwork device 100 fails after the protocol packet is transmitted from the personal user terminal 222 to the server 370, the carrier edge router 310 that has received the response packet from the server 370 receives the route advertisement RA (FIG. 3) performed by the internetwork device 100A. The response packet is transferred to the internetwork apparatus 100B in accordance with the second priority. Since the internetwork device 100A and the internetwork device 100B synchronize the address / port conversion information, when the protocol packet is transferred from the personal user terminal 222 to the server 370 via the internetwork device 100A, the internetwork device 100A. The internetwork apparatus 100B has the address / port conversion information updated in (1). Therefore, the internetwork apparatus 100B converts the destination address (NAT_Pool_Address: IP address held in α) of the response packet into the IP address (local address) of the personal user terminal 224 according to the address / port conversion information, and the local network Transfer to the personal user terminal 224 via the router 260.

A-3. Outbound packet transfer processing:
FIG. 6 is a flowchart showing the flow of outbound packet transfer processing. FIG. 7 is an explanatory diagram showing a packet transfer path in the outbound packet transfer process. The outbound packet transfer process is a process in which the internetwork apparatus 100 that has received the outbound packet OBP from the local network LNET transfers the received packet to the global network GNET. In the following description, an outbound packet transfer process when an outbound packet OBP transmitted from the local network LNET is received by the internetwork device 100A in a redundant configuration of Double ACT in which two internetwork devices 100 are simultaneously operated. Will be described (see FIG. 6).

  In step S110 (FIG. 6), the inside packet interface 101A (FIG. 7) of the internetwork device 100A receives the outbound packet OBP from the local network LNET. In step S <b> 120, the inside packet interface 101 </ b> A transfers the received outbound packet OBP to the route control unit 102.

  In step S130 (FIG. 6), the route control unit 102 (FIG. 7) determines whether the received outbound packet OBP corresponds to the first condition or the second condition. Here, the first condition and the second condition are set so that an arbitrary outbound packet OBP corresponds to one of the first condition and the second condition. For example, the first condition and the second condition in one internetwork apparatus 100 are set so as to have an inverse relationship to the first condition and the second condition in the other internetwork apparatus 100. In the present embodiment, in the internetwork apparatus 100A, the first condition is set to “the source address is an even number”, and the second condition is “the source address is not an even number (odd number)”. Is set. On the other hand, in the internetwork device 100B, the first condition is “the source address is not an even number (so that the relationship between the first condition and the second condition in the internetwork device 100A is opposite) ( The second condition is set to “the source address is an even number”. If the first condition and the second condition are set in this way, an arbitrary outbound packet OBP corresponds to only one of the first condition and the second condition.

  Whether the route control unit 102A (FIG. 7) of the internetwork device 100A has an even number (that is, satisfies the first condition) or an odd number in step S130 (FIG. 6). When it is determined that the outbound packet OBP does not correspond to the first condition and does not correspond to the second condition (step S130: NO), the path control is performed. The unit 102A transfers the outbound packet OBP to the internetwork device 100B via the inside redundant inter-device packet transfer interface 106A (step S140) (see path P2 in FIG. 7). The processing (inter-device transfer outbound packet transfer processing) in the internetwork device 100 that has received the outbound packet OBP (inter-device transfer outbound packet TOBP) transferred from another internetwork device 100 will be described later.

  On the other hand, when it is determined that the outbound packet OBP satisfies the first condition (step S130: YES), the path control unit 102A transfers the outbound packet OBP to the inside address translation unit 104A (step S150) ( (See route P1 in FIG. 7).

  In step S160, the inside address translation unit 104A determines whether the outbound packet OBP is a protocol packet based on the IP header of the received outbound packet OBP. If it is determined that the outbound packet OBP is a protocol packet (step S160: YES), the inside address translation unit 104A holds the transition of the sequence state based on the received protocol packet (step S170). Then, the inside address conversion unit 104A refers to the address / port conversion information and performs address conversion (translation of a transmission source address and a communication port number) (step S200). The source address is converted into an IP address held in NAT_Pool_Address: α.

  On the other hand, when it is determined that the outbound packet OBP is not a protocol packet (step S160: NO), the inside address conversion unit 104A does not hold the transition of the sequence state, and performs address conversion (source address and communication). Port number conversion) is executed (step S200).

  In step S210, the inside address conversion unit 104A transfers the outbound packet OBP after the address conversion to the route control unit 102A, and the route control unit 102A performs routing according to the transmission destination address, and passes through the outside side packet interface 103. The outbound packet OBP is transferred to the global network GNET (see the route P1 in FIG. 7).

  Note that the outbound packet transfer process when the outbound packet OBP is received by the internetwork device 100B is also executed in the same manner as described above. In this case, in step S130 (FIG. 6), the source address of the outbound packet OBP is an odd number (that is, the first condition is met) or an even number (that is, the second condition is met). ), And in accordance with the determination result, the outbound packet OBP transfer process to the internetwork apparatus 100A (step S140) and the process in the own apparatus (steps S160 to S210) are executed.

A-4. Inter-device transfer outbound packet transfer processing:
FIG. 8 is a flowchart showing the flow of inter-device transfer outbound packet transfer processing. The inter-device transfer outbound packet transfer process is a process in which the internetwork device 100 that has received an outbound packet OBP (inter-device transfer outbound packet TOBP) from another internetwork device 100 transfers the received packet to the global network GNET. In the following description, in a redundant configuration of Double ACT in which two internetwork devices 100 are simultaneously operated, an inter-device transfer outbound packet TOBP transferred from the internetwork device 100A is received by the internetwork device 100B. The inter-device transfer outbound packet transfer process will be described (see the route P2 in FIG. 7). The same applies to the contents of the inter-device transfer outbound packet transfer process when the inter-device transfer outbound packet TOBP transferred from the internetwork device 100B is received by the internetwork device 100A.

  In step S310 (FIG. 8), the inside redundant inter-device packet transfer interface 106B (FIG. 7) of the internetwork device 100B receives the outbound packet OBP (inter-device transfer outbound packet TOBP) from the internetwork device 100A. In step S320, the inside redundant unit packet transfer interface 106B transfers the received outbound packet OBP to the path control unit 102B.

  In step S330 (FIG. 8), the path control unit 102B (FIG. 7) transfers the received outbound packet OBP to the inside address translation unit 104B (see path P2 in FIG. 7). In step S340, the inside address translation unit 104B determines whether or not the received outbound packet OBP is a protocol packet.

  When it is determined that the outbound packet OB is a protocol packet (step S340: YES), the inside address translation unit 104B holds the sequence state transition based on the received outbound packet OB (step S350). In step S370, the inside address conversion unit 104 refers to the address / port conversion information and performs address conversion (translation of a transmission source address and a communication port number).

  On the other hand, when it is determined that the outbound packet OBP is not a protocol packet (step S340: NO), the inside address conversion unit 104B refers to the address / port conversion information without holding the transition of the sequence state. Then, address conversion (transmission source address and communication port number conversion) is executed (step S370).

  In step S380, the inside address conversion unit 104B transfers the outbound packet OBP after the address conversion to the route control unit 102B, and the route control unit 102B performs routing according to the destination address and passes through the outside side packet interface 103B. The outbound packet OBP is transferred to the global network GNET (see the route P2 in FIG. 7).

A-5. Inbound packet transfer processing:
FIG. 9 is a flowchart showing the flow of inbound packet transfer processing. FIG. 10 is an explanatory diagram showing a packet transfer path in the inbound packet transfer process. The inbound packet transfer process is a process in which the internetwork apparatus 100 that has received the inbound packet IBP from the global network GNET transfers the received packet to the local network LNET. In the following description, inbound packet transfer processing when an inbound packet IBP transmitted from the global network GNET is received by the internetwork device 100A in a redundant configuration of Double ACT in which two internetwork devices 100 are simultaneously operated. Will be described (see FIG. 10).

  In step S410 (FIG. 9), the outside packet interface 103A (FIG. 10) of the internetwork device 100A receives the inbound packet IBP from the global network GNET. In step S420, the outside-side packet interface 103A transfers the received inbound packet IBP to the route control unit 102A.

  In step S430 (FIG. 9), the path control unit 102A determines whether the inbound packet IBP is a protocol packet based on the IP header of the received inbound packet IBP. If the received inbound packet IBP is a protocol packet (YES in step S430), the path control unit 102A transfers the received inbound packet IBP to the inside address translation unit 104A (step S470) (see path PA1 in FIG. 10).

  In step S480, the inside address translation unit 104A confirms again whether or not the received inbound packet IBP is a protocol packet. When the inbound packet IBP is a protocol packet (step S480: YES), the inside address conversion unit 104A holds the transition of the sequence state based on the received IBP (step S490), and refers to the address / port conversion information. Then, address conversion (transmission destination address and communication port number conversion) is executed (step S500).

  On the other hand, if the inbound packet IBP is not a protocol packet (step S480: NO), the inside address conversion unit 104A refers to the address / port conversion information and performs address conversion (translation of the transmission destination address and communication port number). (Step S500).

  In step S510, the inside address translation unit 104A transfers the inbound packet IBP after the address translation to the route control unit 102A, and the route control unit 102A performs routing according to the transmission destination address, via the inside side packet interface 101A. The inbound packet IBP is transferred to the local network LNET (see the route PA1 in FIG. 10).

  If it is determined in step S430 that the packet is not a protocol packet (step S430: NO), the path control unit 102A transfers the received inbound packet IBP to the outside address translation unit 105A (step S440) (path PA2 in FIG. 10). reference).

  In step S450, the outside address conversion unit 105A refers to the address / port conversion information and performs address conversion (translation of a transmission destination address and a communication port number).

  In step S460, the outside address conversion unit 105A transfers the inbound packet IBP after the address conversion to the route control unit 102A, and the route control unit 102A performs routing according to the transmission destination address, via the inside side packet interface 101A. The inbound packet IBP is transferred to the local network LNET (see the route PA2 in FIG. 10). The inbound packet transfer process when the inbound packet IBP transmitted from the global network GNET is received by the internetwork device 100B is the same as the process in the internetwork device 100A.

A-6. Effects of the embodiment:
As described above, the internetwork apparatus 100A according to the present embodiment has the NAT_Pool_Address: α held by itself as a first priority and redundant configuration for the apparatus (carrier edge router 310) connected to the global network GNET side. NAT_Pool_Address: β that is held by the internetwork apparatus 100B, which is the other party's partner apparatus, performs a route advertisement RA with β as the second priority, and the internetwork apparatus 100B transmits the device (carrier edge router 310) connected to the global network GNET side. NAT_Pool_Address: β held by the own device is first priority, and NAT_Pool_Address: α held by the internetwork device 100A that is the redundant partner device is a route advertisement with α being the second priority. It is doing a B. Therefore, even in a redundant configuration of Double ACT in which two internetwork apparatuses 100A and 100B are operated simultaneously, the transfer path of the protocol packet is uniquely determined, and the sequence state of the protocol packet can be correctly grasped.

  Further, since the internetwork device 100A performs route advertisement RA to the carrier edge router 310 as described above, even if a failure occurs in the internetwork device 100A, the carrier edge router 310 performs route advertisement RA. The packet is transferred to the internetwork apparatus 100B according to the second priority of RA. In addition, the internetwork device 100A transfers the address / port conversion information and the information about the sequence state of the protocol packet to the internetwork device 100B, which is a partner device in a redundant configuration. Therefore, when the internetwork device 100B receives a protocol packet whose destination global address is NAT_Pool_Address: α, the internetwork device 100B is based on the address / port conversion information transferred from the internetwork device 100A and the information on the sequence state of the protocol packet. Thus, it is possible to continue the packet transfer by performing the address conversion of the transmission destination and accurately grasping the sequence state. Therefore, the reliability of packet transfer can be improved.

  Further, in the internetwork apparatus 100, when the inbound packet IBP is a protocol packet, it is transferred to the inside address translation unit 104. The inside address translation unit 104 stores address / port translation information and information about the sequence state of the protocol packet when the outbound packet OBP is transferred, so that the sequence state of the protocol packet can be managed quickly and accurately. it can.

  Moreover, in the internetwork apparatus 100 in a present Example, it distributes to the two internetwork apparatuses 100 based on whether the transmission source address of the outbound packet OBP is an even number or an odd number. Thereby, load distribution in the two internetwork apparatuses 100 is realized.

B. Variations:
The present invention is not limited to the above-described examples and embodiments, and can be implemented in various modes without departing from the gist thereof. For example, the following modifications are possible.

B1. Modification 1:
In the above embodiment, the redundant configuration (Double ACT configuration) in which two internetwork apparatuses 100 having the same function and configuration are simultaneously operated has been described as an example. However, the present invention is N (N is 3 or more). It is also possible to apply to a redundant configuration in which the internetwork apparatus 100 is simultaneously operated. In this case, as in the above embodiment, the route advertisement from the first priority to the Nth priority is performed. Then, all of the N internetwork apparatuses 100 synchronize the address / port conversion information and the information on the sequence state of the protocol packet. This makes it possible to manage the sequence state of protocol packets in a configuration in which N internetwork devices are operated simultaneously. In addition, when all of the N internetwork devices 100 are synchronized with the address / port conversion information and the information regarding the sequence state of the protocol packet, a failure occurs in (N−1) or less internetwork devices 100. However, the protocol packet transfer process can be continued properly.

B2. Modification 2:
In the above-described embodiment, the internetwork apparatus 100 is illustrated as having a configuration including the inside address translation unit 104 and the outside address translation unit 105 as the address translation unit. You may make it the structure which performs address conversion of the packet OBP and the inbound packet IBP.

B3. Modification 3:
In the above embodiment, as a combination of the first condition and the second condition, a combination of the conditions that “the source address is an even number” and “the source address is an odd number” is employed. Other combinations are also possible. For example, as a combination of the first condition and the second condition, “the last digit of the source address is 0-4” and “the last digit of the source address is 5-9” A combination of the conditions “being” may be employed. Even if a combination of the conditions that “the last digit of the source address is 0 or 1” and “the last digit of the source address is any of 2 to 9” is adopted. Good. Further, as a combination of the first condition and the second condition, a combination of the conditions that “the transmission destination address is an even number” and “the transmission destination address is an odd number” may be employed. The load of each internetwork device 100 is monitored, and a combination of conditions is set so that the load shared by each internetwork device 100 is adjusted to a desired value (for example, each load is equalized). It is preferable. Further, the combination of conditions may be updated or set periodically or as needed.

B4. Modification 4:
In the above-described embodiment, the example in which the IP address and the communication port are converted in the internetwork apparatus 100 has been described. However, only the IP address may be converted, or in addition to the IP address and the communication port, the packet may be further converted. It may be configured to convert predetermined information included in.

B5. Modification 5:
In the above embodiment, a part of the configuration realized by hardware may be replaced with software, and conversely, a part of the configuration realized by software may be replaced by hardware.

DESCRIPTION OF SYMBOLS 10 ... Network 100 ... Internetwork apparatus 101 ... Inside side packet interface 102 ... Path control part 103 ... Outside side packet interface 104 ... Inside address converter 105 ... Outside address converter 106 ... Packet transfer between redundant apparatuses for inside Interface 112 ... Dedicated line 122 ... Line 126 ... Line 210 ... Home router 220 ... Individual user 222, 224 ... Individual user terminal 230 ... Corporate router 250 ... Corporate user 260 ... Local network router 300 ... Internet 310 ... Carrier edge router 370 ... Server LNET ... Local network GNET ... Global network OBP ... Outbound packet IBP ... Inbound packet

Claims (4)

An internetwork device,
A receiving unit for receiving packets from the first network;
For at least one of the source address and destination address of a packet, a local address used in a specific network and a global address used between a plurality of networks are mutually converted, and addresses before and after the address conversion are converted. An address translation unit for transferring the address translation information including the address translation information to another internetwork device;
A transmitter that transmits the address-converted packet to the second network;
To the second network, the performs path advertisement global address as the first priority included in the said internetwork apparatus, a route advertisement said global luer dress with the said other internetwork device as a second priority , The route controller,
An internetwork device comprising: An internetwork device according to claim 1, comprising:
The receiving unit is a first receiving unit;
further,
A second receiver for receiving packets from the second network;
The route control unit
An internetwork apparatus that transfers the packet to the address translation unit when the packet received by the second reception unit is a protocol packet. An internetwork device according to claim 1 or 2,
The address conversion unit mutually converts the local address and the global address for at least one of a combination of a source address and a communication port number and a combination of a destination address and a communication port number, and the address conversion The information further includes an internetwork device including the communication port numbers before and after the address conversion. An internetwork device according to any one of claims 1 to 3,
further,
An inter-device packet transfer interface for performing inter-device packet transfer, which is packet transfer with the other internetwork device;
An inter-device packet transfer control unit for causing the received packet to be transferred to the inter-device packet transfer interface based on a load on the internetwork device and the other internetwork device;
An internetwork device comprising:

Images