Patent Description:
In network communication, to prevent a client from being exposed to a public network, the client may be disposed in a private network. The client in the private network is connected to the public network by using a network processing node, to prevent the client from being directly exposed to the public network, thereby improving privacy.

Further, to implement a high availability mechanism, the network processing node is deployed in a cluster mode.

Specifically, in a process of communication between the client and a server, a request packet (namely, an outbound packet) sent by the client to the server is first routed to an active-active cluster. The active-active cluster includes a load balancer node and a plurality of network processing nodes, and the plurality of network processing nodes have a same configuration and function. The load balancer node of the active-active cluster receives the request packet, selects one first network processing node from the plurality of network processing nodes according to a load balancing policy, and sends the request packet to the selected first network processing node. The first network processing node generates forwarding rules (including an outbound forwarding rule and an inbound forwarding rule) for the request packet. After performing network processing such as source network address translation (source net address translateton, SNAT) or an access control list (access control list, ACL) according to the outbound forwarding rule in the forwarding rules, the first network processing node sends a request packet obtained after the network processing to the server. Correspondingly, the server generates a response packet (namely, an inbound packet) based on the request packet obtained after the network processing, and sends the response packet to the active-active cluster. The load balancer node of the active-active cluster receives the request packet, and selects one second network processing node from the plurality of network processing nodes according to the load balancing policy. After performing network processing such as destination network address translation (destination net address translateton, DNAT) or an access control list (access control list, ACL) on the response packet according to the inbound forwarding rule in the forwarding rules, the second network processing node sends a request packet obtained after the network processing to the client. In the foregoing process, when the second network processing node and the first network processing node are not a same node, the second network processing node needs to obtain the inbound forwarding rule from the first network node, to process the response packet according to the inbound forwarding rule.

Because the load balancer node selects the second network processing node according to the load balancing policy, selection of the second network processing node depends on the load balancing policy, and has uncertainty. In general, the first network processing node needs to send the inbound forwarding rule to all network processing nodes in the active-active cluster except the first network processing node.

When the first network processing node synchronizes the forwarding rules in the active-active cluster in a unicast or multicast manner, if the second network processing node does not receive the inbound forwarding rule before receiving the response packet, the second network processing node cannot correctly process the response packet. Consequently, problems such as a packet loss and communication service interruption are caused.

Therefore, how to implement reliable synchronization of the forwarding rules becomes an urgent problem to be resolved currently. Document <CIT> provides a method for a set of service nodes in an active-active service node cluster in conjunction with a host computer hosting a destination data compute node (DCN) to improve the efficiency of directing a data message to a service node storing state information for the flow to which the data message belongs. a first service node receives a data message in a particular data message flow for which it does not maintain state information. The first service node then identifies a second service node to process the data message and forwards the data message to the second service node. The second service node sends state information for the particular data message flow to the first service node, for the first service node to use to process subsequent data messages in the particular data message flow. Document <CIT> discloses a system and method for managing an application delivery controller (ADC) cluster including a plurality of ADCs are provided. The method includes creating a hash table including a plurality of buckets, wherein a number of the plurality of buckets is a multiple of a maximum number of active ADCs that can be supported by the ADC cluster; allocating, to each active ADC of the ADC cluster, one of the plurality of buckets; and instructing at least one network element to distribute traffic to and from the active ADCs based on the hash table.

This application provides an active-active cluster control method and a control node to implement reliable synchronization of forwarding rules between network devices in an active-active cluster, and avoid problems such as a packet loss and service interruption.

With rise of an internet and big data, there is an increasing demand for network bandwidth. Generally, a network node is deployed in a cluster mode, to implement a high availability mechanism. The following describes in detail a system architecture <NUM> in an embodiment of this application with reference to <FIG>.

<FIG> is a schematic block diagram of a system architecture <NUM> for packet traffic forwarding. As shown in <FIG>, the system architecture <NUM> may include a virtual private cloud (virtual private clound, VPC) <NUM> and at least one server (for example, a server <NUM> and a server <NUM>). The following separately describes the foregoing modules in detail.

The VPC <NUM> includes at least one client (for example, a client <NUM> and a client <NUM>) and a network node cluster <NUM>. The network node cluster <NUM> may include at least one network processing node. For ease of description, in this embodiment of this application, an example in which the network node cluster <NUM> includes nodes <NUM>, <NUM>, and <NUM> is used for description.

It should be understood that the VPC <NUM> may also be replaced with a data center. This is not specifically limited in this embodiment of this application.

It should be further understood that the client may be a virtual machine (virtual machine, VM) or a container. In addition, when the VPC <NUM> is replaced with the data center, the client may alternatively be a physical device. This is not specifically limited in this embodiment of this application.

The client and the client may first send, to a node in the network node cluster <NUM>, a request packet sent to the server. The network processing node in the network node cluster <NUM> performs traffic processing on the request packet and then forwards the request packet to the server.

For example, a load balancer node <NUM> in the VPC <NUM> receives a request packet sent by the client <NUM>, and distributes, according to a load balancing policy, the request packet to a node in the network node cluster <NUM> for processing, to implement load balancing.

The load balancer node <NUM> may be specifically implemented in a plurality of manners. This is not specifically limited in this embodiment of this application. In an example, the load balancer node <NUM> may be a load balancer. The load balancer may form a hash (hash) algorithm based on a combination of a destination address, a destination port, a source address, a source port, and a protocol number that are of the request packet, and perform distribution processing on the request packet based on a result of the hash algorithm, thereby implementing traffic load balancing of the request packet. In another example, the load balancer node <NUM> may alternatively be an equal-cost multi-path (equal cost multi-path, ECMP) device, or a link aggregation control protocol (link aggregation control protocol, LACP) device.

In this embodiment of this application, an outbound packet sent by a client in a private network is routed to the load balancer node <NUM> before being sent to a public network, and an inbound packet sent by a server in the public network is routed to the load balancer node <NUM> before reaching the private network.

It should be understood that the destination address, the destination port, the source address, the source port, and the protocol type of the request packet mentioned before are forwarding information of the request packet.

It should be further understood that the load balancer in this embodiment of this application may be a layer <NUM> (layer <NUM>, L3) load balancer, or may be a layer <NUM> (layer <NUM>, L7) load balancer.

The network node cluster <NUM> is not specifically limited in this embodiment of this application. In an example, the network node cluster <NUM> may be a source network address translation (source network address translation, SNAT) cluster, and is responsible for modifying the source address of the request packet. For example, the client <NUM> sends the request packet to the server <NUM>. The source address of the request packet is an IP address of the client <NUM>. The network node cluster <NUM>, as the SNAT cluster, may modify the source address of the request packet from the IP address of the client <NUM> to a unified external IP address (generally an external address of a gateway) of the data center <NUM>. In another example, the network node cluster <NUM> may alternatively be a destination network address translation (destination network address translation, DNAT) cluster, and is responsible for modifying a destination address of a response packet. For example, the server <NUM> sends a response packet to the client <NUM>, and a destination address of the response packet is the unified external IP address of the data center <NUM>. The network node cluster <NUM>, as the DNAT cluster, may modify the destination address of the response packet from the unified external IP address of the data center <NUM> to the IP address of the client <NUM>. In another example, the network node cluster <NUM> may alternatively be a firewall (fire wall, FW) cluster. A security protection policy is deployed in the network node cluster <NUM>, and the network node cluster <NUM> is responsible for performing a security check, a permission check, and the like on a request packet or a response packet.

It should be noted that the unified external address of the VPC <NUM> may also be referred to as a public internet protocol (public internet protocol, PIP) address and is referred to as a public IP address for short.

The network processing node in the network node cluster <NUM> may be a physical device, or may be a virtual machine. This is not specifically limited in this embodiment of this application.

In a process of processing the request packet sent by the client, a node in the network node cluster <NUM> records the forwarding information of the request packet. The forwarding information may include but is not limited to <NUM>-tuple structure information of the packet. When the response packet passes through the node in the network node cluster <NUM>, the node in the network node cluster <NUM> determines whether there is information about a corresponding request packet. If the response packet has the corresponding request packet, traffic that depends on or is associated with the response packet and the corresponding request packet is referred to as stateful traffic. If the response packet does not have the corresponding request packet, traffic that does not depend on or is not associated with the response packet and the corresponding request packet is referred to as stateless traffic.

Specifically, after receiving the request packet, the node in the network node cluster <NUM> may record the destination address, the destination port, the source address, the source port, and the protocol number that are of the request packet. Specifically, after receiving the response packet, the node in the network node cluster <NUM> may record a destination address, a destination port, a source address, a source port, and a protocol number that are of the response packet. If the protocol number of the request packet is the same as that of the response packet, the destination address of the request packet is the source address of the response packet, the destination port of the request packet is the source port of the response packet, the destination address of the response packet is the source address of the request packet, and the destination port of the response packet is the source port of the request packet, traffic associated with the request packet and the response packet may be understood as stateful traffic.

For the stateful traffic, the request packet and the response packet need to be processed by a same node in the network node cluster <NUM>. Specifically, the network node cluster <NUM> is a stateful cluster, and the node in the network node cluster <NUM> needs to store a related forwarding rule, so that after receiving the response packet, the node in the network node cluster <NUM> may determine, according to the forwarding rule stored in the node, that the traffic associated with the response packet is stateful traffic, and performs traffic processing on the response packet.

It should be understood that the forwarding rule may also be understood as a forwarding rule for processing a packet. A representation form of the forwarding rule is not specifically limited in this embodiment of this application. For example, the forwarding rule may be a flow table, or may be a routing rule.

For example, the network node cluster <NUM> is a NAT cluster, and the forwarding rule may be a forwarding rule based on <NUM>-tuple structure information of the request packet. After receiving the request packet sent by the client <NUM> to the server <NUM>, the node in the network node cluster <NUM> records the <NUM>-tuple structure information of the request packet. In addition, according to the locally stored forwarding rule that is based on the <NUM>-tuple structure information, the source address of the request packet is modified from the IP address of the client <NUM> to a unified public IP address of the data center <NUM> or a unified public IP network address of an enterprise internal network, and the request packet is forwarded to the server <NUM>.

After receiving the response packet sent by the server <NUM> to the client <NUM>, the node in the network node cluster <NUM> determines, based on the <NUM>-tuple structure of the response packet and the forwarding rule stored in the node, whether the traffic is stateful traffic. When the response packet is stateful traffic, the node modifies, according to the locally stored forwarding rule, the destination address of the response packet from the unified external IP address of the data center <NUM> to the IP address of the client <NUM>, and forwards the response packet to the client <NUM>.

For the stateful traffic, the request packet and the response packet need to be processed by the same node in the network node cluster <NUM>. The traffic processing is performed based on stored stateful traffic. However, packet traffic is sent to the node in the network node cluster <NUM> by using the load balancer node <NUM>. Therefore, the request packet and the response packet corresponding to the request packet may not be processed by the same node in the network node cluster <NUM>. Therefore, the node in the network node cluster <NUM> needs to synchronize the stored forwarding rule, so that after receiving the response packet, the node may process the response packet according to the stored forwarding rule. In this way, a packet loss caused by a lack of the forwarding rule is avoided.

For example, the network node cluster <NUM> is an active-active cluster. Referring to <FIG>, the node <NUM>, the node <NUM>, and the node <NUM> in the network node cluster <NUM> may simultaneously process the packet traffic. When a node is faulty, traffic on the node is distributed to another node in the network node cluster <NUM> for processing. In a conventional technical solution, a forwarding rule is synchronized among the node <NUM>, the node <NUM>, and the node <NUM> in a multicast manner.

For example, the network node cluster <NUM> is an active-standby cluster. Referring to <FIG>, in all nodes in the network node cluster <NUM>, only one node that processes traffic is referred to as a master node (master), and another node (generally referred to as a slaver node (slaver)) becomes a master node and starts to process traffic after the master node is faulty. In the conventional technical solution, a master node in the network node cluster <NUM> stores a forwarding rule, and the master node synchronizes the forwarding rule to another slaver node in a unicast manner.

In the foregoing technical solutions in which the forwarding rule is synchronized in the unicast or multicast manner, it is prone to cause the packet loss and service interruption. First, in a process that the forwarding rule is synchronized in the unicast or multicast manner, the forwarding rule is not synchronized in real time. Therefore, it is prone to cause the packet loss and the service interruption. Then, if time for processing a message in the unicast or multicast manner is longer than time for returning the response packet corresponding to the request packet to the node in the network node cluster <NUM>, the packet loss and the service interruption may also be caused. In addition, for the active-active cluster, because it is not determined that the response packet is forwarded to a specific node in the network node cluster <NUM>, all nodes in the network node cluster <NUM> need to receive and store all forwarding rules. Consequently, an overall capacity specification is limited.

According to an active-active cluster control method provided in this embodiment of this application, for the active-active cluster of the network node cluster <NUM>, a forwarding rule of each node in the network node cluster <NUM> may be stored in an independent control node. In a process in which each node in the network node cluster <NUM> processes traffic, if the node does not locally store a forwarding rule, the node may obtain the forwarding rule from the independent control node, to implement reliable synchronization of the forwarding rules and avoid the packet loss, the service interruption, and the like. In addition, the forwarding rules are stored in the independent control node, and there is no need to store the forwarding rules on each node, thereby improving the overall capacity specification of the cluster service.

With reference to the architecture shown in <FIG>, the following describes in detail a packet traffic processing method provided in this embodiment of this application by using an example in which the network node cluster <NUM> is a NAT cluster.

It should be noted that the forwarding rule may be stored in a cache of the control node, or may be stored in a configuration management database (configuration management database, CMDB) of the control node. This is not specifically limited in this embodiment of this application.

<FIG> is a schematic block diagram of a system architecture <NUM> for packet traffic forwarding according to an embodiment of this application. As shown in <FIG>, a control node <NUM> is added to the system architecture <NUM> based on the system architecture <NUM> shown in <FIG>.

It should be noted that the control node <NUM> may be located inside a VPC <NUM>, or may be located outside the VPC <NUM>. This is not specifically limited in this embodiment of this application. For ease of description, in <FIG>, an example in which the control node <NUM> is located inside the VPC <NUM> is used for description.

The control node <NUM> may store a forwarding rule. After receiving packet traffic, any node in a network node cluster <NUM> obtains the forwarding rule from the control node <NUM>, and processes the packet traffic according to the forwarding rule.

It should be noted that the control node <NUM> may be centralized, or may be distributed. This is not specifically limited in this embodiment of this application.

Optionally, in some embodiments, the control node <NUM> may be a software-defined networking (software defined network, SDN) controller. The SDN controller may generate a forwarding rule after receiving forwarding information that is of a request packet and that is reported by any node in the network node cluster <NUM>, and deliver the generated forwarding rule to the node in the network node cluster <NUM>, so that the node processes, according to the forwarding rule, the request packet or a response packet corresponding to the request packet.

The following describes in detail a packet traffic processing method provided in an embodiment of this application with reference to <FIG> and <FIG> by using an example in which the network node cluster <NUM> shown in <FIG> is a NAT cluster, and the control node <NUM> is an SDN controller.

<FIG> and <FIG> are schematic flowcharts of a packet traffic processing method according to an embodiment of this application. The method shown in <FIG> and <FIG> may include steps <NUM> to <NUM>. The following separately describes steps <NUM> to <NUM> in detail.

Step <NUM>: A tenant sends a service creation command to a cloud management platform.

The tenant may send the service creation command to the cloud management platform. There are a plurality of specific implementations. This is not specifically limited in this application. In an example, the tenant may send the service creation command by using a console (console) on the cloud management platform. In another example, the tenant may further send the service creation command by using an application programming interface (application program interface, API) on a cloud platform.

In a possible implementation, in this embodiment of this application, the tenant may send the service creation command by using a VPC as a granularity. It should be understood that all clients in the VPC share at least one public IP address, and access an external network by using the public IP address.

Step <NUM>: The cloud management platform generates a configuration scheme for an SDN controller according to the service creation command.

The cloud management platform may generate the configuration scheme for the SDN controller <NUM> according to the service creation command. The configuration scheme may indicate the SDN controller <NUM> to create a NAT service and perform initialization.

Optionally, in some embodiments, the service creation command sent by the tenant to the cloud management platform may include a range of available public network ports, and the configuration scheme generated by the cloud management platform for the SDN controller <NUM> may include the range of available public network ports, so that the SDN controller <NUM> selects one public network port from the range of available public network ports. The public network port one-to-one corresponds to a source IP address and a source port of a first request packet.

Step <NUM>: The SDN controller <NUM> receives the configuration scheme sent by the cloud management platform.

Step <NUM>: The SDN controller <NUM> performs initialization.

After receiving the configuration scheme sent by the cloud platform, the SDN controller <NUM> parses and creates the NAT service. The SDN controller <NUM> may further allocate an available public IP address to the client in the VPC, and create an empty NAT forwarding configuration library corresponding to the NAT service. The NAT forwarding configuration library may store a NAT forwarding rule.

The SDN controller <NUM> may further configure a forwarding plane for each node in a network node cluster <NUM>.

Specifically, the SDN controller <NUM> delivers an OpenFlow flow table to each node in the network node cluster <NUM>. The OpenFlow flow table is used to indicate each node in the network node cluster <NUM> to send a query request to the SDN controller <NUM> when forwarding information of a received packet does not match the locally stored NAT forwarding entry.

Each node in the network node cluster <NUM> is configured with an internal network adapter and an external network adapter. The internal network adapter is connected to a private network, and the external network adapter is connected to a public network. The node may modify the received packet according to the forwarding rule, and select, based on a destination address of a modified packet, a network adapter to send the modified packet. For example, when the destination address of the modified packet is a private network address, the internal network adapter is selected to send the modified packet to the private network. When the destination address of the modified packet is a public network address, the external network adapter is selected to send the modified packet to the public network.

It should be understood that: When each node in the network node cluster <NUM> is a physical device, the network adapter may be a physical adapter; and when each node in the network node cluster <NUM> is a virtual machine, the network adapter may be a virtual adapter.

Step <NUM>: A node <NUM> receives the first request packet sent by a client <NUM> to a server <NUM>.

For example, the client <NUM> sends the first request packet to the server <NUM>, and the first request packet may be routed to a load balancer node <NUM>. For example, a default gateway of the client <NUM> may be set to a network address of the load balancer node <NUM>. When a destination address and the source address that are of the first request packet are not in a same range of subnets, the first request packet may be routed to the default gateway, the load balancer node <NUM> selects the node <NUM> according to a load balancing policy, and sends the first request packet to the node <NUM> in the network node cluster <NUM>. The source IP address of the first request packet is an IP address of the client <NUM>, and the destination address of the first request packet is an IP address of the server <NUM>.

The first request packet sent by the client <NUM> to the server <NUM> may carry forwarding information, and the forwarding information records a sending direction of the first request packet as an outbound direction.

It should be understood that in this embodiment of this application, the outbound direction is a direction from the client to the server, and an inbound direction is a direction from the server to the client. The outbound direction may be understood as a packet sent from the client in the VPC <NUM> to the server outside the VPC <NUM>, or a packet sent from a client in a local area network to a server outside the local area network. The inbound direction may be understood as a packet sent from the server outside the VPC <NUM> to the client in the VPC <NUM>, or a packet sent from the server outside the local area network to the client in the local area network.

Step <NUM>: The node <NUM> sends the query request to the SDN controller <NUM>, where the query request is used to query an outbound forwarding rule corresponding to the forwarding information of the first request packet.

After receiving the first request packet sent by the client <NUM>, the node <NUM> determines, based on the forwarding information of the first request packet, whether the node <NUM> locally stores the outbound forwarding rule for processing the first request packet. If the node <NUM> does not locally store the outbound forwarding rule, the node <NUM> reports, based on the OpenFlow flow table delivered by the SDN controller <NUM>, the forwarding information of the first request packet to the SDN controller <NUM> for query.

Step <NUM>: The SDN controller <NUM> delivers the outbound forwarding rule to the node <NUM>.

The forwarding information of the first request packet may be, for example, <NUM>-tuple structure information (for example, the source IP address, the source port, a destination IP address, a destination port, and a packet type that are of the first request packet) of the first request packet. After receiving the query request, send by the node <NUM>, that is used to query the outbound forwarding rule corresponding to the forwarding information of the first request packet, the SDN controller <NUM> performs query, based on the <NUM>-tuple structure information (for example, the source IP address, the source port, the destination IP address, the destination port, and the packet type that are of the first request packet) of the first request packet, in the NAT forwarding configuration library.

Optionally, in some embodiments, if the NAT forwarding configuration library does not store the outbound forwarding rule corresponding to the first request packet, it may be understood that the first request packet is the first packet of the server <NUM> accessed by the client <NUM>. The corresponding outbound forwarding rule may be generated based on the forwarding information of the first request packet, and the generated outbound forwarding rule is delivered to the node <NUM>. In addition, the SDN controller <NUM> may further generate an inbound forwarding rule whose direction is opposite to that of the outbound forwarding rule. In addition, the outbound forwarding rule and the inbound forwarding rule are stored in the NAT forwarding configuration library. Therefore, after receiving a response packet corresponding to the first request packet, another node in the network node cluster <NUM> may directly obtain the inbound forwarding rule from the NAT forwarding configuration library, and forwards the response packet.

The outbound forwarding rule and the inbound forwarding rule are bidirectional forwarding rules based on the forwarding information of the first request packet. The outbound forwarding rule is as follows: A source IP address of a received outbound packet is modified to the public IP (PIP) address, and a source port of the received outbound packet is modified to the public network port. The inbound forwarding rule is as follows: A destination IP address of a received inbound packet is modified to the IP address of the client <NUM>, and a destination port of the received inbound packet is modified to the source port of the first request packet.

In this embodiment of this application, the SDN controller <NUM> records the public IP address and the range of available public network ports. The SDN controller <NUM> selects one public network port from the range of available public network ports. The public network port one-to-one corresponds to the source IP address and the source port of the first request packet.

It should be understood that the range of available public network ports may be defined by an administrator.

In an example, the IP address of the client <NUM> is <NUM>. <NUM>, and the IP address of the server <NUM> is <NUM>. The source IP address of the first request packet sent by the client <NUM> to the server <NUM> is <NUM>. <NUM>, and the source port of the first request packet is <NUM>. The destination IP (namely, the IP address of the server <NUM>) address of the first request packet is <NUM>. <NUM>, and the destination port of the first request packet is <NUM>. The public IP address recorded in the SDN controller <NUM> is <NUM>. <NUM>, and the range of available public network ports is from <NUM> to <NUM>.

The following describes in detail a specific implementation of the outbound forwarding rule by using an example in which the SDN controller <NUM> selects a public network port <NUM> from the available public network port ranging from <NUM> to <NUM>.

The outbound forwarding rule is used as an example. The source IP address of the first request packet is modified from <NUM>. <NUM> to <NUM>. <NUM>, and the source port of the first request packet is modified from a port <NUM> to the port <NUM>. After processing is performed according to the outbound forwarding rule, the source IP address of the first request packet is <NUM>. <NUM>, the source port of the first request packet is <NUM>, the destination IP address of the first request packet is <NUM>. <NUM>, and the destination port of the first request packet is <NUM>.

In another example, a source IP address (namely, the IP address of the server <NUM>) of a first response packet sent by the server <NUM> to the client <NUM> is <NUM>. <NUM>, a source port of the first response packet is <NUM>, a destination IP address of the first response packet is <NUM>. <NUM>, and a destination port of the first response packet is <NUM>. Because the destination IP address of the first response packet is the same as the source IP address of the first request packet after the processing, and the destination port of the first response packet is the same as the source port of the first request packet after the processing, it may be understood that the first response packet is stateful traffic of the first request packet, and the first response packet corresponds to the first request packet.

The inbound forwarding rule is used as an example. When the first response packet is the stateful traffic of the first request packet, the destination IP address of the first response packet is modified from <NUM>. <NUM> to <NUM>. <NUM>, and the destination port of the first response packet is modified from the port <NUM> to the port <NUM>. After processing is performed according to the inbound forwarding rule, the source IP address of the first response packet is <NUM>. <NUM>, the source port of the first response packet is <NUM>, the destination IP address of the first response packet is <NUM>. <NUM>, and the destination port of the first response packet is <NUM>.

Optionally, in some embodiments, if the NAT forwarding configuration library stores the outbound forwarding rule corresponding to the first request packet, the SDN controller <NUM> may directly deliver the outbound forwarding rule to the node <NUM>.

Step <NUM>: The node <NUM> performs network processing on the first request packet according to the outbound forwarding rule delivered by the SDN controller <NUM>.

The node <NUM> may modify the source IP address of the first request packet to the PIP address and modify the source port of the first request packet to a port X according to the outbound forwarding rule corresponding to the first request packet, and perform forwarding based on that the destination IP address of the first request packet is the IP address of the server <NUM> and the destination port of the first request packet is a port <NUM>.

For example, the node <NUM> modifies the source IP address of the first request packet from <NUM>. <NUM> to <NUM>. <NUM>, and modifies the source port of the first request packet from the port <NUM> to the port <NUM> according to the outbound forwarding rule. After the node <NUM> processes the first request packet, the source IP address of the first request packet is <NUM>. <NUM>, the source port of the first request packet is <NUM>, the destination IP address of the first request packet is <NUM>. <NUM>, and the destination port of the first request packet is <NUM>.

Step <NUM>: The node <NUM> forwards the first request packet to the server <NUM>.

For example, the node <NUM> may send the first request packet to the public network by using the external network adapter based on that the source IP address of the first request packet is <NUM>. <NUM>, the source port of the first request packet is <NUM>, the destination IP address of the first request packet is <NUM>. <NUM>, and the destination port of the first request packet is <NUM>. The first request packet is forwarded to the server <NUM> (the destination IP address of the server <NUM> is <NUM>. <NUM>) by using a routing device of the public network.

The packet traffic processing method provided in this embodiment of this application is further described in detail below by using <FIG> with reference to steps <NUM> to <NUM>.

Step <NUM>: The server <NUM> sends the first response packet to a node <NUM>.

After receiving the first request packet, the server <NUM> generates the first response packet based on the first request packet. The first response packet carries content required by the first request packet, for example, a web page. The first response packet carries forwarding information. The forwarding information includes the destination IP address, the destination port, the source IP address, the source port, and a protocol type. The destination IP address is the public IP address, the destination port is the public network port, the source IP address is the IP address of the server <NUM>, and the source port is a port, of the server <NUM>, that provides a service. Because the source address of the packet is the IP address of the server <NUM>, and the destination port is the public network port of the VPC, the forwarding information records a sending direction of the first response packet as an inbound direction.

The first response information sent by the server <NUM> is routed to a load balancer node based on the destination address of the server <NUM>. The load balancer node selects a specific node in the network node cluster <NUM> according to the load balancing policy, and sends the first response packet to the node.

For ease of description, the following provides description by using an example in which the first response packet sent by the server <NUM> is sent by the load balancer node <NUM> to the node <NUM> in the network node cluster <NUM>.

Step <NUM>: The node <NUM> requests the SDN controller <NUM> to query the inbound forwarding rule.

After receiving the first response packet sent by the server <NUM>, the node <NUM> determines the direction of the first response packet based on the forwarding information of the first response packet, for example, the source IP address, the source port, the destination IP, the destination port, and the protocol type. Because the source IP address of the first response packet is the IP address of the server, and the destination IP address of the first response packet is the public IP address, the first response packet is an inbound packet.

The node <NUM> further determines, based on the forwarding information of the first response packet, whether the node <NUM> locally stores the inbound forwarding rule that matches the forwarding information of the first response packet. Specifically, the node <NUM> searches the locally stored forwarding rule for a forwarding rule for modifying the public IP address. If there is the forwarding rule for modifying the public IP address, it indicates that the node <NUM> locally stores the inbound forwarding rule that matches the forwarding information of the first response packet. Otherwise, the node <NUM> does not locally store the inbound forwarding rule that matches the forwarding information of the first response packet.

If the node <NUM> does not locally store the inbound forwarding rule that matches the forwarding information of the first response packet, the node <NUM> reports, based on the OpenFlow flow table delivered by the SDN controller <NUM>, the forwarding information of the first request packet to the SDN controller <NUM> for query.

Step <NUM>: The node <NUM> receives the inbound forwarding rule delivered by the SDN controller <NUM>.

After receiving a query request, send by the node <NUM>, that is used to query the inbound forwarding rule corresponding to the first response packet, the SDN controller <NUM> performs query in the NAT forwarding configuration library based on the forwarding information of the first response packet (for example, the source IP address, the source port, the destination IP address, the destination port, and the packet type that are of the first response packet). If the first response packet is stateful traffic, in other words, the first response packet corresponds to the first request packet, and the NAT forwarding configuration library stores the outbound forwarding rule and the inbound forwarding rule corresponding to the outbound forwarding rule. The SDN controller <NUM> may deliver the inbound forwarding rule to the node <NUM>.

It should be understood that the SDN controller <NUM> may determine, based on that the destination IP address of the first response packet is the public IP address and the destination port of the first response packet is the public network port, that the first response packet is a stateful-traffic packet of the first request packet.

Optionally, in some embodiments, if the SDN controller <NUM> does not find the inbound forwarding rule in the NAT forwarding configuration library, it may be understood that the first response packet is not stateful traffic, but packet traffic that is actively requested to be sent by an external network device to the VPC <NUM>. In this embodiment of this application, for security consideration, the SDN controller <NUM> may not generate the inbound forwarding rule corresponding to the first response packet, and the network processing node directly discards the first response packet when not obtaining the inbound forwarding rule delivered by the SDN controller <NUM>.

Step <NUM>: The node <NUM> processes the first response packet according to the inbound forwarding rule.

Optionally, in some embodiments, after receiving the outbound forwarding rule delivered by the SDN controller <NUM>, the node <NUM> may modify the destination IP address of the first response packet from the public IP address to the IP address of the client <NUM> and modify the destination port from the public network port to the source port of the first request packet according to the inbound forwarding rule.

For example, based on foregoing example, the node <NUM> may modify the destination IP address of the first response packet from <NUM>. <NUM> to <NUM>. <NUM> and modify the destination port of the first response packet from <NUM> to <NUM> according to the inbound forwarding rule. After the node <NUM> processes the first response packet, the source IP address of the first response packet is <NUM>. <NUM>, the source port of the first response packet is <NUM>, the destination IP address of the first response packet is <NUM>. <NUM>, and the destination port of the first response packet is <NUM>.

Step <NUM>: The node <NUM> forwards the first response packet to the client <NUM>.

For example, the node <NUM> may select the internal network adapter based on the destination IP address <NUM>. <NUM> of the first response packet, and send the first response packet from the internal network adapter to the client <NUM> in the private network.

Optionally, in some other embodiments, if the node <NUM> does not receive the inbound forwarding rule delivered by the SDN controller <NUM>, the node <NUM> may discard the first response packet.

Optionally, in some embodiments, if a node in the network node cluster <NUM> is faulty, for example, the node <NUM> is faulty, the load balancer node <NUM> no longer sends a request packet or a response packet to the faulty node <NUM>.

There are a plurality of specific implementations. This is not specifically limited in this embodiment of this application. In an example, the load balancer node <NUM> may delete, according to an indication of the SDN controller <NUM>, an entry for forwarding a packet to the faulty node <NUM>. After receiving the packet, the load balancer node <NUM> no longer distributes the packet to the faulty node <NUM> for processing. In another example, the load balancer node <NUM> may further detect, based on a mechanism of an ECMP or an LACP, that the node <NUM> is faulty, and no longer distribute a packet to the faulty node <NUM> for processing.

It should be noted that a node fault in this embodiment of this application includes but is not limited to a network adapter fault and a network element fault that are reported by a node, and a node fault that is sensed by the SDN controller <NUM> (for example, the node fault is sensed in a keepalive manner).

The following describes in detail the packet processing method provided in this embodiment of this application by using an example in which the node <NUM> is faulty, and the load balancer node <NUM> distributes packet traffic processed by the node <NUM> to a node <NUM> in the network node cluster <NUM>.

In step <NUM>, after learning that the node <NUM> is faulty, the load balancer node <NUM> sends the first response packet that needs to be processed by the node <NUM> to the node <NUM> in the network node cluster <NUM> for processing.

In step <NUM>, the node <NUM> requests the SDN controller <NUM> to query the inbound forwarding rule.

After receiving the first response packet sent by the server <NUM>, the node <NUM> determines, based on the forwarding information of the first response packet, whether the node <NUM> locally stores the inbound forwarding rule. If the node <NUM> does not locally store the inbound forwarding rule, the node <NUM> reports, based on the OpenFlow flow table delivered by the SDN controller <NUM>, the forwarding information of the first request packet to the SDN controller <NUM> for query.

In step <NUM>, the node <NUM> receives the inbound forwarding rule delivered by the SDN controller <NUM>.

After receiving a query request, send by the node <NUM>, that is used to query the inbound forwarding rule corresponding to the first request packet, the SDN controller <NUM> stores the inbound forwarding rule in the NAT forwarding configuration library based on the forwarding information of the first response packet, and delivers the inbound forwarding rule to the node <NUM>.

In step <NUM>, the node <NUM> processes the first response packet according to the inbound forwarding rule.

Based on the foregoing example, the node <NUM> may modify the destination IP address of the first response packet from <NUM>. <NUM> to <NUM>. <NUM> and modify the destination port of the first response packet from <NUM> to <NUM> according to the inbound forwarding rule. After the processing is performed according to the inbound forwarding rule, the source IP address of the first response packet is <NUM>. <NUM>, the source port of the first response packet is <NUM>, the destination IP address of the first response packet is <NUM>. <NUM>, and the destination port of the first response packet is <NUM>.

In step <NUM>, the node <NUM> sends the first response packet to the private network by using the internal network adapter, and then forwards the first response packet to the client <NUM> by using a router (not shown in the figure) in the private network.

In this embodiment of this application, when a node in the network node cluster <NUM> is faulty, another node processes a packet by obtaining the stored NAT forwarding rule from the SDN controller <NUM>, to avoid normal communication interruption and a packet loss because the node is faulty and the NAT forwarding rule is not synchronized in a conventional solution.

Optionally, in some embodiments, after the faulty node <NUM> recovers, and after receiving traffic of a to-be-processed packet, the node <NUM> may read, from the SDN controller <NUM> based on forwarding information of the traffic of the to-be-processed packet, a stored forwarding rule for processing the to-be-processed packet.

Optionally, in some embodiments, if the node in the network node cluster <NUM> does not receive, in a period of time, a packet that needs to be processed, the node deletes the locally stored forwarding rule for processing the packet traffic. This may also be understood as rule aging. If the node receives the packet that needs to be processed again, the node may read, from the SDN controller <NUM> based on forwarding information of the to-be-processed packet, the stored forwarding rule for processing the packet.

With reference to the architecture shown in <FIG>, the following describes in detail the packet traffic processing method provided in this embodiment of this application by using an example in which the network node cluster <NUM> is a firewall (firewall, FW) cluster.

<FIG> is a schematic block diagram of another system architecture <NUM> for packet traffic forwarding according to an embodiment of this application. As shown in <FIG>, a network node cluster <NUM> is an FW cluster.

It should be understood that the FW cluster is a barrier between a private network and a public network, and may control entry and exit of a data packet according to a predefined forwarding rule. As a defense line of a system, the FW cluster is used to prevent an unauthorized user from accessing the system.

An SDN controller <NUM> may store a forwarding rule. After receiving packet traffic, any node in the network node cluster <NUM> obtains the forwarding rule from the controller <NUM>, and determines, according to the forwarding rule, whether the packet traffic can be forwarded.

The following describes in detail a packet traffic processing method provided in an embodiment of this application with reference to <FIG> and <FIG> by using an example in which the network node cluster <NUM> shown in <FIG> is an FW cluster.

<FIG> and <FIG> are schematic flowcharts of another packet traffic processing method according to an embodiment of this application. The method shown in <FIG> and <FIG> may include steps <NUM> to <NUM>. The following separately describes steps <NUM> to <NUM> in detail.

The step is corresponding to step <NUM>. For details, refer to the descriptions in step <NUM>, and details are not described herein again.

Step <NUM>: The cloud management platform receives the command and generates a configuration scheme for an SDN controller according to the command.

The cloud management platform may generate the control scheme for the SDN controller <NUM> according to the service creation command. The control scheme may indicate the SDN controller <NUM> to create an FW service and perform initialization.

After receiving the configuration scheme sent by the cloud platform, the SDN controller <NUM> parses and creates the FW service. The SDN controller <NUM> may further create an empty FW forwarding configuration library corresponding to the FW service, and the FW forwarding configuration library may store an FW forwarding rule.

The SDN controller <NUM> may further configure a forwarding plane for each node in a network node cluster <NUM>. This is used as an example, but not for limitation. The SDN controller <NUM> delivers an OpenFlow flow table to each node in the network node cluster <NUM>. The OpenFlow flow table is used to indicate each node in the network node cluster <NUM> to send a query request to the SDN controller <NUM> when forwarding information of a received packet does not match the locally stored NAT forwarding entry. For details, refer to the descriptions in step <NUM>, and details are not described herein again.

Step <NUM>: A node <NUM> receives a first request packet sent by a client <NUM> to a server <NUM>.

For example, the client <NUM> sends the first request packet to the server <NUM>, and the first request packet may be routed to a load balancer node <NUM>. For example, a default gateway of the client <NUM> may be set to a network address of the load balancer node <NUM>. When a destination address and the source address that are of the first request packet are not in a same range of subnets, the first request packet may be routed to the default gateway, the load balancer node <NUM> selects the node <NUM> according to a load balancing policy, and sends the first request packet to the node <NUM> in the network node cluster <NUM>.

It should be understood that in this embodiment of this application, the outbound direction is a direction from the client to the server, and an inbound direction is a direction from the server to the client. The outbound direction may be understood as a packet sent from the client in a VPC <NUM> to the server outside the VPC <NUM>, or a packet sent from a client in a local area network to a server outside the local area network. The inbound direction may be understood as a packet sent from the server outside the VPC <NUM> to the client in the VPC <NUM>, or a packet sent from the server outside the local area network to the client in the local area network.

Step <NUM>: The node <NUM> sends a query request to the SDN controller <NUM>, where the query request is used to query an outbound forwarding rule corresponding to the forwarding information of the first request packet.

The forwarding information of the first request packet may be, for example, <NUM>-tuple structure information (for example, a source IP address, a source port, a destination IP address, a destination port, and a packet type that are of the first request packet) of the first request packet. After receiving the query request, send by the node <NUM>, that is used to query the outbound forwarding rule corresponding to the forwarding information of the first request packet, the SDN controller <NUM> may configure the outbound forwarding rule based on the source network address and the destination network address that are of the first request packet. The outbound forwarding rule includes a correspondence between the source network address and the destination network address that are of the first packet.

It should be noted that the source network address of the first packet may be the source IP address of the first packet, or may be the source IP address and the source port that are of the first packet. The destination network address of the first packet may be the destination IP address of the first packet, or may be the destination IP address and the destination port that are of the first packet.

It should be understood that the outbound forwarding rule is used to indicate a node, in the network node cluster <NUM>, that receives the outbound forwarding rule to determine whether a destination network address of a packet whose sending direction is the outbound direction is a preset network address. If the destination network address of the packet whose sending direction is the outbound direction is the preset network address, the node sends the packet whose sending direction is the outbound direction based on the destination network address of the packet whose sending direction is the outbound direction. If the destination network address of the packet whose sending direction is the outbound direction is not the preset network address, the node discards the packet whose sending direction is the outbound direction.

The SDN controller <NUM> may further configure an inbound forwarding rule based on the source network address and the destination network address that are of the first packet and that are recorded in the outbound forwarding rule. The inbound forwarding rule includes the correspondence between the source network address and the destination network address that are of the first packet.

It should be understood that the inbound forwarding rule is used to indicate a node, in the network node cluster <NUM>, that receives the inbound forwarding rule to determine whether a destination network address of a packet whose sending direction is the inbound direction is the source network address of the first packet. If the destination network address of the packet whose sending direction is the inbound direction is the source network address of the first packet, the node sends the packet whose sending direction is the inbound direction based on the destination network address of the packet whose sending direction is the inbound direction. If the destination network address of the packet whose sending direction is the inbound direction is not the source network address of the first packet, the node discards the packet whose sending direction is the inbound direction.

In this embodiment of this application, the SDN controller <NUM> may further store the outbound forwarding rule and the inbound forwarding rule in the FW forwarding configuration library, so that after receiving a response packet corresponding to the first request packet, another node in the network node cluster <NUM> may directly obtain the inbound forwarding rule from the FW forwarding configuration library, and forward the response packet.

In an example, the IP address of the client <NUM> is <NUM>. <NUM>, and the IP address of the server <NUM> is <NUM>. The source IP address of the first request packet sent by the client <NUM> to the server <NUM> is <NUM>. <NUM>, and the destination IP address of the first request packet (namely, the IP address of the server <NUM>) is <NUM>. The outbound forwarding rule allows a packet whose source IP address is <NUM>. <NUM> and destination address is <NUM>. <NUM> to pass through. The inbound forwarding rule allows a packet whose source IP address is <NUM>. <NUM> and destination address is <NUM>. <NUM> to pass through.

The node <NUM> may receive the outbound forwarding rule corresponding to the first request packet, and determine, according to the outbound forwarding rule, whether the source network address and the destination network address that are of the first request packet meet a condition.

For example, the source IP address of the first request packet sent by the client <NUM> to the server <NUM> is <NUM>. <NUM>, and the destination IP address of the first request packet is <NUM>. The node <NUM> determines, based on that the outbound forwarding rule allows the packet whose source IP address is <NUM>. <NUM> and whose destination address is <NUM>. <NUM> to pass through, that the first request packet is allowed to pass through.

Step <NUM>: The server <NUM> sends a first response packet to a node <NUM>.

After receiving the first request packet, the server <NUM> generates the first response packet based on the first request packet. The first response packet carries content required by the first request packet, for example, a web page. The first response packet carries forwarding information. The forwarding information includes a destination IP address, a destination port, a source IP address, a source port, and a protocol type. The source IP address of the first response packet is the IP address of the server <NUM>, and the source port of the first response packet is a port, of the server <NUM>, that provides a service. Because the source address of the packet is the IP address of the server <NUM>, and the destination port of the packet is a public network port of the VPC, the forwarding information records a sending direction of the first response packet as an inbound direction.

After receiving the first response packet sent by the server <NUM>, the node <NUM> determines the direction of the first response packet based on the forwarding information of the first response packet, for example, the source IP address, the source port, the destination IP, the destination port, and the protocol type. Because the source IP address of the first response packet is the IP address of the server, and the destination IP address is a public IP address, the first response packet is an inbound packet.

The node <NUM> further determines, based on the forwarding information of the first response packet, whether the node <NUM> locally stores the inbound forwarding rule that matches the forwarding information of the first response packet. If the node <NUM> does not locally store the inbound forwarding rule, the node <NUM> reports, based on the OpenFlow flow table delivered by the SDN controller <NUM>, the forwarding information of the first request packet to the SDN controller <NUM> for query.

After receiving a query request, send by the node <NUM>, that is used to query the inbound forwarding rule corresponding to the first response packet, the SDN controller <NUM> performs query in the FW forwarding configuration library based on the network address included in the forwarding information of the first response packet. If the first response packet is stateful traffic, in other words, the first response packet corresponds to the first request packet, the FW forwarding configuration library stores the outbound forwarding rule and the inbound forwarding rule corresponding to the outbound forwarding rule. The SDN controller <NUM> may deliver the inbound forwarding rule to the node <NUM>.

It should be understood that the SDN controller <NUM> may determine, based on that the destination network address of the first response packet is the source network address of the first packet, that the first response packet is a stateful-traffic packet of the first request packet.

The node <NUM> may receive the inbound forwarding rule corresponding to the first request packet, and determine, according to the inbound forwarding rule, whether the source IP network address and the destination IP network address that are of the first response packet meet a condition.

For example, based on foregoing example, the source IP address of the first request packet sent by the client <NUM> to the server <NUM> is <NUM>. <NUM>, and the destination IP address of the first request packet is <NUM>. The node <NUM> determines, based on that the inbound forwarding rule allows the packet whose source IP address is <NUM>. <NUM> and whose destination address is <NUM>. <NUM> to pass through, that the first request packet is allowed to pass through.

It may be understood that, in this embodiment of this application, each step may be performed in different sequences presented in this embodiment of this application, and not all operations in this embodiment of this application may need to be performed.

The foregoing describes in detail the packet traffic processing method provided in the embodiments of this application with reference to <FIG> and <FIG>. The following describes in detail apparatus embodiments of this application with reference to <FIG>. It should be understood that descriptions of the method embodiments correspond to descriptions of the apparatus embodiments. Therefore, for a part that is not described in detail, refer to the foregoing method embodiments.

<FIG> is a schematic structural diagram of a control node <NUM> according to an embodiment of this application. It should be understood that the control node <NUM> is corresponding to the controller <NUM> in the foregoing description.

Optionally, the control node <NUM> records a public IP address and a range of available public network ports, and the forwarding information of the first packet includes a source IP address and a source port that are of the first packet.

The configuration module <NUM> is specially configured to select a public network port from the range of public network ports. The public network port one-to-one corresponds to the source IP address and the source port that are of the first packet. The outbound forwarding rule includes a correspondence between the source IP address and the source port that are of the first packet and the public IP address and the public network port. The outbound forwarding rule is used to indicate a network processing node, in the active-active cluster, that receives the outbound forwarding rule to modify a source IP address of a packet whose sending direction is the outbound direction to the public IP address and modify a source port of the packet whose sending direction is the outbound direction to the public network port.

Optionally, the configuration module <NUM> is further configured to generate the inbound forwarding rule based on the correspondence that is recorded in the outbound forwarding rule and that is between the source IP address and the source port that are of the first packet and the public IP address and the public network port. The inbound forwarding rule includes the correspondence between the source IP address and the source port that are of the first packet and the public IP address and the public network port. The inbound forwarding rule is used to indicate a network processing node, in the active-active cluster, that receives the inbound forwarding rule to modify a destination IP address of a packet whose sending direction is the inbound direction to the source address of the first packet and modify a destination port of the packet whose sending direction is the inbound direction to the source port of the first packet.

Optionally, the forwarding information of the second packet includes a destination IP address and a destination port that are of the second packet.

The determining module <NUM> is specially configured to determine that the destination IP address of the second packet is the public IP address, and determine that the destination port of the second packet is the public network port.

Optionally, the first packet is sent by a client to a server, the client and the active-active cluster are set in a virtual private cloud VPC network, and the public IP address is set in the VPC network.

Optionally, the forwarding information of the first packet includes the source network address and a destination network address that are of the first packet. The configuration module <NUM> is further configured to configure the outbound forwarding rule based on the source network address and the destination network address that are of the first packet. The outbound forwarding rule includes a correspondence between the source network address and the destination network address that are of the first packet. The outbound forwarding rule is used to indicate a network processing node, in the active-active cluster, that receives the outbound forwarding rule to determine whether a destination network address of a packet whose sending direction is the outbound direction is a preset network address. If the destination network address of the packet whose sending direction is the outbound direction is the preset network address, the configuration module <NUM> sends the packet whose sending direction is the outbound direction based on the destination network address of the packet whose sending direction is the outbound direction. If the destination network address of the packet whose sending direction is the outbound direction is not the preset network address, the configuration module <NUM> discards the packet whose sending direction is the outbound direction.

Optionally, the configuration module <NUM> is specifically configured to configure the inbound forwarding rule based on the source network address and the destination network address that are of the first packet and that are recorded in the outbound forwarding rule. The inbound forwarding rule includes the correspondence between the source network address and the destination network address that are of the first packet. The inbound forwarding rule is used to indicate a network processing node, in the active-active cluster, that receives the inbound forwarding rule to determine whether a destination network address of a packet whose sending direction is the inbound direction is the source network address of the first packet. If the destination network address of the packet whose sending direction is the inbound direction is the source network address of the first packet, the configuration module <NUM> sends the packet whose sending direction is the inbound direction based on the destination network address of the packet whose sending direction is the inbound direction. If the destination network address of the packet whose sending direction is the inbound direction is not the source network address of the first packet, the configuration module <NUM> discards the packet whose sending direction is the inbound direction.

Optionally, the forwarding information of the second packet includes the destination network address of the second packet. The determining module <NUM> is specifically configured to determine that the destination network address of the second packet is the source network address of the first packet.

It should be understood that the control node <NUM> in this embodiment of this application may be implemented by using an application-specific integrated circuit (application-specific integrated circuit, ASIC), or may be implemented through a programmable logic device (programmable logic device, PLD). The PLD may be a complex programmable logic device (complex programmable logical device, CPLD), a field programmable gate array (field-programmable gate array, FPGA), generic array logic (generic array logic, GAL), or any combination thereof. Alternatively, when the methods shown in <FIG> and <FIG> may be implemented by using software, the control node <NUM> and modules of the control node <NUM> may be software modules.

A specific function of each functional module is also described in the embodiments shown in <FIG> and <FIG>, and details are not described herein again.

<FIG> is a schematic structural diagram of a control node <NUM> according to an embodiment of this application. The control node <NUM> includes a processing unit <NUM> and a communications interface <NUM>. The processing unit <NUM> is configured to perform functions defined by various software programs. For example, the processing unit <NUM> is configured to implement a function of the control node <NUM>. The communications interface <NUM> is configured to communicate and interact with another computing node. The another device may be another physical server. Specifically, the communications interface <NUM> may be a network adapter.

Optionally, the control node <NUM> may further include an input/output interface <NUM>. The input/output interface <NUM> is connected to an input/output device and is configured to receive input information and output an operation result. The input/output interface <NUM> may be a mouse, a keyboard, a display, a CD-ROM drive, or the like. Optionally, the control node <NUM> may further include a secondary memory <NUM>. The secondary memory is generally referred to as an external memory. A storage medium of the secondary memory <NUM> may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, an optical disc), a semiconductor medium (for example, a solid-state drive), or the like.

Optionally, the control node <NUM> may further include a bus <NUM>. The processing unit <NUM>, the communications interface <NUM>, the input/output interface <NUM>, and the secondary memory <NUM> may be connected through the bus <NUM>. The bus <NUM> may be a peripheral component interconnect (peripheral component interconnect, PCI) bus, an extended industry standard architecture (extended industry standard architecture, EISA) bus, and or the like. The bus <NUM> may be classified into an address bus, a data bus, a control bus, and the like. For ease of representation, only one line is used to represent the bus in <FIG>, but this does not mean that there is only one bus or only one type of bus.

The processing unit <NUM> may have a plurality of specific implementation forms. For example, the processing unit <NUM> may include a processor <NUM> and a memory <NUM>. The processor <NUM> performs, according to program instructions stored in the memory <NUM>, related operations in the embodiments shown in <FIG> and <FIG>. The processor <NUM> may be a central processing unit (central processing unit, CPU). The processor may be a general purpose processor, a digital signal processor (digital signal processor, DSP), an application-specific integrated circuit (application specific integrated circuit, ASIC), a field programmable gate array (field programmable gate Array, FPGA), or another programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The general purpose processor may be a microprocessor, or the processor may be any conventional processor or the like. Alternatively, the processor <NUM> is configured to execute a related program by using one or more integrated circuits, to implement technical solutions provided in the embodiments of this application.

The foregoing and other operations and/or functions of the units in the control node <NUM> are separately used to implement corresponding procedures of the methods in <FIG> and <FIG>. For brevity, details are not described herein again.

All or some of the foregoing embodiments may be implemented by using software, hardware, firmware, or any combination thereof. When the software is used to implement the embodiments, the foregoing embodiments may be implemented completely or partially in a form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the procedures or functions according to the embodiments of this application are all or partially generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable apparatuses. The computer instructions may be stored in a computer-readable storage medium or may be transmitted from a computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center in a wired (for example, a coaxial cable, an optical fiber, or a digital subscriber line (DSL)) or wireless (for example, infrared, radio, or microwave) manner. The computer-readable storage medium may be any usable medium accessible by the computer, or a data storage device, for example, a server or a data center, integrating one or more usable media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium may be a solid-state drive (solid state drive, SSD).

Whether the functions are performed by the hardware or the software depends on particular applications and design constraints of the technical solutions. A person skilled in the art may use different methods to implement the described functions for each particular application.

It may be clearly understood by the person skilled in the art that, for a purpose of convenient and brief description, for a detailed working process of the foregoing system, apparatus, and unit, refer to a corresponding process in the foregoing method embodiments, and details are not described herein again.

For example, division into units is merely logical function division and may be other division in an actual implementation. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be implemented by using some interfaces. The indirect coupling or communication connection between the apparatuses or units may be implemented in electronic, mechanical, or other forms.

Some or all of the units may be selected based on an actual requirement to achieve objectives of the solutions of the embodiments.

Claim 1:
An active-active cluster control method, comprising:
receiving(S330), by a control node, a first query request sent by a first network processing node in an active-active cluster, wherein the first query request carries forwarding information of a first packet, and the forwarding information of the first packet records a sending direction of the first packet as an outbound direction;
configuring, by the control node, an outbound forwarding rule based on the forwarding information of the first packet, generating an inbound forwarding rule whose direction is opposite to that of the outbound forwarding rule, recording the outbound forwarding rule and the inbound forwarding rule, and sending(S335) the outbound forwarding rule to the first network processing node;
receiving(S355), by the control node, a second query request sent by a second network processing node in the active-active cluster, wherein the second query request carries forwarding information of a second packet, and the forwarding information of the second packet records a sending direction of the second packet as an inbound direction; and
determining, by the control node, that the forwarding information of the second packet matches the inbound forwarding rule, obtaining, based on the forwarding information of the second packet, the recorded inbound forwarding rule, and sending the inbound forwarding rule to the second network processing node.