WO2008037210A1

WO2008037210A1 - Method and device for transferring message in virtual private lan

Info

Publication number: WO2008037210A1
Application number: PCT/CN2007/070735
Authority: WO
Inventors: Xindong Teng
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-09-28
Filing date: 2007-09-20
Publication date: 2008-04-03
Also published as: CN100514929C; CN1921441A

Abstract

A method and a device for transferring message in a Virtual Private LAN are disclosed. The method includes steps as following: receive message from a Virtual Switching Instance (VSI) in the Virtual Private LAN; if the VSI, from which the message comes, is a member of a Super Virtual Switching Instance (Super-VSI) set, the Super-VSI transfers the message to its destination port. According to the invention, set the Super-VSI, enable ARP agent function as required and create Layer 3 logic interfaces, so as users of different VSI in the Virtual Private LAN can access external network or access one another, without creating more VSIs at Provider Edges (PE). Therefore, setting and managing of the Virtual Private LAN is simplified, and it is more convenient for the user in the Virtual Private LAN to access the external network or access one another.

Description

Message forwarding method and device for virtual private local area network

Technical field

The present invention relates to a virtual private local area network, and more particularly to a message forwarding method and apparatus for a virtual private local area network shared by multiple virtual switching instances by setting a shared virtual switching instance. Background of the invention

Virtual Private LAN Services (VPLS) is a Layer 2 Virtual Private Network (VPN) technology that provides similar LANs over a Multi Protocol Label Switching (MPLS) network. LAN, Local Area Network) The function of the service allows users to access the network from multiple geographically dispersed points and access each other as if they were directly connected to the LAN. The role of VPLS is a virtual LAN switch.

Figure 1 is a typical networking diagram of VPLS. As shown in the figure, the interface where the user edge device (CE, Custom Edge) resides is added to the virtual switch instance (VSI, Virtual Switch Instance) in the VPLS. The Provider Edge is connected to each other through PW (Pseudo Wire) to form a simulated LAN for the client. Each PE performs user MAC address learning (including the CE side and the PW side) in the virtual switching instance. The item is published so that CE users who join the same virtual switching instance can access each other at the second layer. The VPLS PW usually uses an MPLS tunnel or any other tunnel, such as GRE, L2TPV3, and TE. The function of the VPLS PW is to transparently transmit Ethernet packets.

Here, you need to introduce the QinQ (two-layer label technology, 802.lQ-in-802.lQ) technology. QinQ, also known as the virtual LAN stack (VLAN-Stack), is a technology for encapsulating two layers of virtual local area network tags (VLAN TAGs) for Ethernet packets. The private network VLAN TAG is encapsulated in the public network VLAN TAG. The packet carries the two layers of TAGs to traverse the backbone network of the service provider. The public network VLAN TAG is stripped off at the edge of the service provider's backbone network to restore the private network VLAN TAG. Therefore, the user is provided with a relatively simple single layer VLAN TAG tunnel.

In practical applications, an individual or enterprise user can access the Internet access network through a virtual private LAN access to a broadband access server (BRAS, Broadband Remote Access Server) that acts as a remote access authentication device. A user or enterprise user can perform Layer 2 access within the same virtual switching instance through the virtual private LAN. The user can also be isolated by VLANs. However, because different users cannot communicate with each other, they need to be divided into different virtual switching instances. At the same time, all users can access the same broadband access server device, and the broadband access server device can assign users IP addresses of different network segments, and the user accesses the broadband access server according to the IP address and accesses the Internet network. .

As shown in Figure 2, users belonging to the same virtual switching instance (the two virtual switching instances in the figure: VSI1 and VSI2) can access each other through the virtual private LAN. When accessing the Internet through the broadband access server, the PE and BRAS are required. A VLAN sub-interface is created. Different sub-interfaces need to be added to VSI1 and VSI2. When the user data carries the user VLAN, the user data of the PE device to the BRAS device becomes QinQ packets (with two layers of labels). The broadband access server needs to be terminated. The QinQ message.

Therefore, when users of different virtual switching instances access the BRAS through the PE, many virtual switching instances need to be created on the PE, and many sub-interfaces are created between the PE and the BRAS. Different sub-interfaces are added to different virtual switching instances. Very complicated. Summary of the invention

The main purpose of the present invention is through the operator edge device in the virtual private local area network A shared virtual switching instance (Super-VSI) is set up to implement interworking between multiple virtual switching instances and a shared virtual switching instance to reduce the complexity of configuration and management of virtual private local area network access to the three-layer network. In addition, users of different virtual switching instances are isolated at Layer 2 by sharing virtual switching instances, but Layer 3 mutual access can be easily implemented.

The above object of the present invention is achieved as follows:

A packet forwarding method for a virtual private local area network includes:

Receiving a message from a virtual switching instance in the virtual private local area network;

When the virtual switching instance from which the packet is sent is a member of the configured shared virtual switching instance, the shared virtual switching instance forwards the packet to its destination.

The packet forwarding device of the virtual private local area network is provided by the embodiment of the present invention, including: at least one shared virtual switching instance, configured with multiple members, the member being at least one virtual switching instance in the virtual private local area network;

The shared virtual switching instance is configured to receive a packet from the virtual switching instance in the virtual private local area network; and when the virtual switching instance from the packet is the configured member, the packet is sent to the packet Destination forwarding.

The beneficial effects of the invention are:

1. Implementing sharing or aggregation of multiple virtual switching instances in a virtual private local area network to reduce the complexity of configuration and management;

The shared virtual switching instance can implement Layer 2 isolation in different virtual switching instances, but can implement Layer 3 mutual access. Applications such as security-based considerations prevent Layer 2 attacks between virtual switching instances. The text forwarding device uniformly controls whether users of different virtual switching instances can access each other;

3. The virtual private instance network (VSI-interface), that is, the three-layer logical interface, implements the virtual private local area network access to the three-layer network, and solves the problem of not sharing the virtual exchange instance when accessing, for each virtual exchange instance. All build a related three-tier logical interface, and And configuring an IP address will consume a lot of IP addresses. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a typical networking diagram of a virtual private local area network in the prior art;

2 is a schematic diagram of a user accessing a broadband access server through a virtual private local area network in the prior art;

3 is a schematic diagram of a user accessing a broadband access server via a virtual private local area network using the present invention;

FIG. 4 is a schematic diagram of implementing three-layer access by different virtual switching instance users through a virtual private local area network and a shared virtual switching instance by using the present invention. Mode for carrying out the invention

The present invention will be further described in detail below with reference to the accompanying drawings.

The core content of the present invention is that, by setting a shared virtual switching instance on a packet forwarding device of a virtual private local area network (for example, a carrier edge device PE), multiple virtual switching instances are interconnected with one shared virtual switching instance to reduce virtuality. The complexity of the configuration and management of the dedicated local area network to the three-layer network; in addition, the address resolution protocol (ARP) proxy function and the three-layer logical interface can be set up on the packet forwarding device provided with the shared virtual switching instance. Users of different virtual switching instances are connected in Layer 2 and Layer 3 access.

The invention will now be described in detail in conjunction with the drawings and embodiments.

The packet forwarding method of the virtual private local area network provided by the present invention mainly includes the following steps: setting a packet forwarding device in the virtual private local area network, where the packet forwarding device includes at least one shared virtual switching instance;

Configure the members of the shared virtual switch instance, which are in the virtual private LAN. Any one or more virtual exchange instances other than the shared virtual exchange instance;

When a user in the virtual private local area network sends a text message through the virtual switching instance to which the user belongs, that is, when the user sends a text through the virtual switching instance of the member to which the user belongs, the virtual virtual switching instance is forwarded to the destination end of the text.

The following describes the PE in the virtual private local area network as an example. The shared virtual switching instance in the present invention is a shared virtual switching instance that can share multiple virtual switching instances. Super-VSI, the Super-VSI is set on the packet forwarding device, that is, the carrier edge device PE in this embodiment. For convenience of explanation, a Super-VSI packet forwarding device is set here. It is called Super Carrier Edge Device (Super-PE).

Next, configure multiple members for the shared virtual switching instance. This member can be called a member virtual switching instance (Sub-VSI), that is, multiple virtual switching instances in the virtual private local area network, which can be all in the virtual private local area network. The virtual switch instance is configured to share members of the virtual switch instance, or you can configure only a part. As for the method of configuration, there is no limitation in the present invention. As long as the sharing relationship between the Super-VSI and the Sub-VSI is established, all the virtual switching instances of the member can communicate with the shared virtual switching instance in the virtual private local area network. can.

According to the above setting, when the user in the virtual private local area network sends a request, the packet forwarding device can be further forwarded by the shared virtual switching instance. The following description will be made separately according to the request of the user and the drawings. Example 1. A user of a virtual private LAN requests authentication online:

FIG. 3 is a schematic diagram of realizing virtual private local area network users accessing the Internet through a broadband access server by using Super-VSI. As shown in Figure 3, Super-PE is an edge device connected to a virtual private LAN and a broadband access server. Super-VSI is configured on the Super-PE. The Super-VSI includes VSI1 and VSI2 in the virtual private local area network are used as member virtual switching instances. This is not limited to this. It can include all virtual switching instances. The Super-VSI includes VSI1 and VSI2 as examples. The interface of the super-PE connected to the server is added to the Super-VSI, so that users of VSI1 and VSI2 can send the packet to the Super-VSI of the Super-PE and forward it to the broadband access server for authentication and Internet access.

Because the users of different clients connect to the authentication access server through the virtual switching instance to access the Internet is the content of the prior art, and the present invention only replaces the virtual switching instance connected with the BRAS in the prior art by using a shared virtual switching instance, that is, Super-VSI. The authentication is implemented on the Internet. Therefore, the specific access process is not mentioned here.

In addition, for the BRAS to distinguish users of different virtual switching instances, the super-PE interface connected to the BRAS can be configured as a QinQ interface, and the user packets of different virtual switching instances are mapped to different outer VLANs. QinQ terminates and distinguishes users. For example, you can distinguish different VLANs to which users belong.

A special case is that when the Super-VSI is processed, all the data without VLANs sent from other virtual switching instances that are not members of the Super-VSI are uniformly used to perform QinQ encapsulation. When the user VLAN is not allowed to be sent through the virtual private LAN, the interface between the Super-PE and the broadband access server is the common physical interface.

The specific implementation method is:

Step 1: Configure the Super-VSI on the Super-PE and configure the member Sub-VSI of the Super-VSI. In this embodiment, VSI1 and VSI2 are configured as virtual exchange instances of the member.

Step 2: Establish related elements of the virtual private local area network of the PE1, the PE2, and the super-PE. Here, the PE may be all the PEs in the virtual private local area network, and is not limited to PE1 and PE2. For example, PE3 may be further included. PE1 and PE2 are used as examples. The process Specifically, the VPLS PW tunnels are established, and the interfaces related to the PC1 and PC2 on the PE1 and the PE2 are added to the corresponding VSIs. This process is the existing processing flow of the VPLS, and is not described here.

Step 3: The user PC2 sends an authentication request message to the Super-PE as the packet forwarding device via the virtual switching instance VSI2 to which the user belongs.

Step 4: Add the interface connected to the broadband access server to the Super-VSI. Configure the interface type as a QinQ interface or a common interface. For the QinQ interface, you need to configure the mapping between the VSI and the outer label. Configure the default outer label of VSI user packets without VLANs as required.

Step 5: After receiving the authentication request packet sent by the user PC2 of the virtual private local area network, the Super-PE checks whether the VSI2 to which it belongs is a member of the Super-VSI. If yes, the Super-VSI is the packet forwarding device. And all the members of the configuration, the sub-VSI (VSI1 and VSI2), find the MAC forwarding entry, and find the corresponding outgoing interface to send, in this embodiment, the interface connected to the access server;

If the outbound interface is a QinQ interface, the request packet is encapsulated in QinQ by using the default virtual LAN label and then forwarded.

If the packet is the first packet, or the corresponding MAC address forwarding entry is not found, the interface corresponding to the Super-VSI and all the member Sub-VSIs (including the PW but not the interface that receives the current packet) In addition, the MAC address learning is performed in the range of the virtual switching instance, and the related information is saved. This process is also the existing processing flow of the virtual private local area network, and will not be described here.

In this embodiment, the interface connected to the access server, such as the BRAS, is added to the Super-VSI, and the interface type is configured as a QinQ interface or a common interface. For a QinQ interface, you need to configure the mapping between the VSI and the outer label. For a common interface, you can configure the default outer label of VSI user packets without VLANs. In this way, users of different virtual switching instances of the VPLS network can easily access the BRAS and access the Internet through the Super-VSI, thereby eliminating the need to set multiple sub-interfaces corresponding to different virtual switching instances on the BRAS, and also reduce The number of virtual switching instances created on the PE reduces the complexity of configuration and management. Example 2: Users requesting mutual access of different virtual switching instances in the virtual private local area network: In this embodiment, when users of different virtual switching instances need to perform three-layer mutual access, the packet forwarding device, that is, the Super in this embodiment - The arp proxy function is enabled at the PE, that is, the ARP proxy unit can be included in the Super-PE.

The arp proxy function refers to the process of proxying the arp request message in the different broadcast domains that are isolated by the user. In the present invention, the arp proxy function needs to be implemented for users in the Sub-VSI of all members of the Super-VSI. The proxy asks the user to send the text to the local, that is, the packet forwarding device, and forwards it locally.

As shown in Figure 4, users of VSI1 and VSI2 cannot access each other. For example, PC1 and PC2 in the figure have IP addresses of IP1 and IP2, which belong to the same network segment. ARP request packets sent by PC1 cannot reach PC2. Therefore, PC1 will not receive the arp response message of PC2, so the MAC address of PC2 cannot be obtained, so PC1 cannot send IP packets to PC2.

When the Super-VSI is configured on the Super-PE, the Layer 3 logical interface associated with the Super-VSI is configured, and the IP address and MAC address of the Layer 3 logical interface are configured. The members of the Super-VSI include VSI1 and VSI2. At this time, the arp request message (broadcast message) of PC1 can be sent to Super-PE, and the super-PE starts the arp proxy function. When the IP address of PC1 is checked as the IP address of the proxy, it is in the range of Super-VSI. The internal (ie, VSI1 and VSI2) sends an arp request message to look up the MAC address of PC2. The arp request message will be sent to PC2 through PE2. PC2 sends back an arp response message to Super-PE, and then Super-PE sends back arp to PCI through arp proxy function. In response to the message, inform "PC2's MAC address", please note that at this time, Super-PE tells The MAC address of the PCI is not the real MAC address of the PC2, but the MAC address of the Layer 3 logical interface. This completes the Layer 2 isolation. Then the PC1 sends an IP data packet to the PC2. The IP data packet will be received locally. It is sent to the Layer 3 logical interface for processing, and is forwarded to PC2 by checking the routing table. PC1 and PC2 implement Layer 3 access.

The specific implementation method is:

Step 1: Configure Super-VSI on the Super-PE and configure the member Sub-VSI of the Super-VSI. In this embodiment, VSI1 and VSI2 are configured as virtual exchange instances of the member.

Step 2: Set at least one Layer 3 logical interface related to the Super-VSI, and configure an IP address and a MAC address of the Layer 3 logical interface.

Step 3: Establish related elements of the virtual private local area network of the PE1, the PE2, and the super-PE. Here, all the PEs in the virtual private local area network may be used, and are not limited to PE1 and PE2, and may include, for example, PE3. Here, only PE1 is used. The PE2 is used as an example. The process includes the establishment of a mutual VPLS PW tunnel. The interfaces related to the PC1 and PC2 on PE1 and PE2 are added to the corresponding VSI. This process is the existing processing flow of the VPLS. Again;

Step 4: The user PC1 of the virtual private local area network sends an arp request message to access PC2, where PC1 belongs to VSI1 at PE1, its IP address is IP1, PC2 belongs to VSI2 at PE2, its IP address is IP2, and the arp request The virtual switching instance VSI1 to which the user PC1 belongs is sent to the text forwarding device Super-PE;

Step 5: The packet forwarding device Super-PE checks the user PC2, that is, whether the IP address of the destination user is the IP address of the proxy, that is, whether it is the IP address of the user of the member virtual switching instance, and if so, proceed Next steps.

Step 6: The Super-PE performs the arp proxy function, and the arp proxy function needs to implement proxying for users in the Sub-VSI of all members of the Super-VSI. The super-PE checks the MAC address corresponding to the IP address of the destination user PC2 in the arp request packet, and the process can perform the search by using the shared virtual switching instance and its configured members. If not, the arp request is sent. The message is sent to the shared virtual switching instance Super-VSI and all its members Sub-VSI (can be requested in addition to the requesting user); Step 7: The Super-PE sends an arp response message to the PC1 to inform the PC2 of the MAC address, here, The MAC address is actually the MAC address of the Layer 3 logical interface.

Step 8: PC1 sends a data packet to the Super-PE. The Super-PE sends the data packet to the Layer 3 logical interface, and then forwards it to PC2 through the lookup routing table.

In the prior art, users of different virtual switching instances are isolated at the second layer, and cannot perform three-layer mutual access between each other. With the present invention, further, the shared virtual switching instance Super-VSI set by the present invention is utilized. Users of different virtual switching instances in the virtual private local area network can be easily isolated on the second layer, but access each other at the third layer. In this way, in actual applications, the Layer 2 attack behavior between virtual switching instances can be prevented. The packet forwarding device can control whether users of different virtual switching instances can access each other. Example 3: A user in a virtual private LAN requests to access a Layer 3 network:

This example is similar to the second example. It is accessed at Layer 3. The difference is that when the packet forwarding device checks the IP address of the destination user as the IP address of the Layer 3 logical interface, it directly sends back the arp response message to request the user to When a data packet is sent, it is sent directly to the Layer 3 logical interface and forwarded through the lookup routing table.

As shown in Figure 4, the right side of the Super-PE device is the IP network, and the left side is the virtual private LAN. When users of different virtual switching instances in the virtual private LAN (for example, PC1 and PC2) want to access users in the IP network, You can create a Layer 3 logical interface (called VSI-interface) on the packet forwarding device, and then configure an IP address on the VSI-interface. The IP address belongs to the same network segment as IP1 and IP2, so PC1 and PC2 can Access to users in the three-tier IP network. The specific implementation method is:

Step 2: Establish related elements of the virtual private local area network of the PE1, the PE2, and the super-PE. Here, the PE may be all the PEs in the virtual private local area network, and is not limited to PE1 and PE2. For example, PE3 may be further included. PE1 and PE2 are used as an example. The process includes the establishment of mutual VPLS PW tunnels. The interfaces related to users PC1 and PC2 on PE1 and PE2 are added to the corresponding VSI. This process is the existing processing flow of VPLS. No longer;

Step 3: Set at least one Layer 3 logical interface VSI-interface associated with the Super-VSI on the packet forwarding device, and configure an IP address on the Layer 3 logical interface that belongs to the same network segment as the IP address of the Sub-VSI user. And configuring the MAC address; in addition, the Super-PE needs to implement the routing function, that is, the outbound interface can be found as the VSI-interface through the destination address such as IP1;

Step 4: The user of the virtual private local area network, for example, the PC1 sends the data, and the virtual exchange instance VSI1 to which the user belongs is sent to the packet forwarding device Super-PE; the MAC address of the packet; if the judgment result is yes And the packet forwarding device sends the access request packet to the third layer for processing, and searches the routing table for forwarding;

When the outbound interface is a Layer 3 logical interface, the packet forwarding device Super-PE searches for the MAC address corresponding to the destination IP address in the Super-VSI and all member Sub-VSI ranges and sends a message through the corresponding VSI; When present, the packet forwarding device Super-PE sends an arp request message to the shared virtual instance Super-VSI and its member Sub-VSI to find the MAC address. In this example, you can create a super-VSI-related Layer 3 logical interface VSI-interface on the super-PE, and configure an IP address that belongs to the same network segment as the IP addresses of all Sub-VSI users on the interface and set the MAC address. The virtual private local area network can be accessed to the three-layer network through the Super-VSI. At this time, the Super-PE must find its outgoing interface VSI-interface through the destination address to implement the routing function.

It should be noted that the virtual private local area network of the present invention can create multiple Super-VSIs and multiple VSI-interfaces on a packet forwarding device, such as a carrier edge device, and apply in a single Super-VSI and VSI-interface. In the above rule, access between different VSI-interfaces is handled according to the access of the normal Layer 3 interface, that is, general route forwarding is performed.

According to the above description, the present invention further provides a packet forwarding system and a packet forwarding device of a virtual private local area network, where the system includes: multiple clients, the multiple clients may be distributed in different geographical locations, The client may be connected to the virtual private local area network through at least one carrier edge device in each geographical location; at least one packet forwarding device, in the embodiment of the present invention, is a Super-PE, the newspaper The file forwarding device includes at least one shared virtual switching instance Super-VSI, configured to forward a user request in the virtual private local area network, where the shared virtual switching instance Super-VSI multiple virtual switching instances are used for The shared virtual switching instances are interconnected, which are VSI1 and VSI2 in this embodiment.

The packet forwarding device further includes an interface connected to the access server, and the request packet of the user of the virtual private local area network is forwarded to the office through the interface through the processing of the shared virtual switching instance of the packet forwarding device. The access server is authenticated and connected to the Internet. The interface can be configured as a QinQ interface. The interface can be configured as a common interface. The interface can be configured as a common interface. Default outer label of the user packet of the virtual switching instance. In addition, the text forwarding device further includes an arp proxy unit that proxyes all members of the shared virtual switching instance, and the arp request message of the user according to different virtual switching instances of the virtual private local area network is in the sharing. The virtual switch instance and all its members find the destination user MAC address and isolate it at Layer 2 to implement Layer 3 mutual access.

In addition, the packet forwarding device further includes at least one Layer 3 logical interface, where an IP address belonging to the same network segment as the user of the virtual private local area network is configured, so that the user of the virtual private local area network implements three Layer access.

In summary, the present invention is a packet forwarding device in a virtual private local area network, for example, setting a shared virtual switching instance on an operator edge device, and starting the arp proxy function and creating a three-layer logical interface to complete the virtual private operation according to requirements. Users of different virtual switching instances in the local area network access the external network or access each other without creating too many virtual switching instances on the carrier edge device and creating many sub-interfaces between the carrier edge device and the external network. The configuration and management of the virtual private local area network is simplified, which makes it easier for users in the virtual private local area network to access the external network and isolate or access each other.

The above embodiments are only intended to illustrate the present invention, and are not intended to limit the application thereto. Any changes and modifications made by the application of the shared virtual exchange instance in accordance with the present invention are intended to be included in the scope of the present invention.

Claims

Claim

A packet forwarding method for a virtual private local area network, characterized in that the method includes the following steps:

The method of claim 1, wherein the shared virtual switching instance forwards the packet to its destination: the shared virtual switching instance determines an outbound interface corresponding to the packet, and passes The determined outbound interface forwards the message to its destination.

The method of claim 2, wherein when the user in the virtual private local area network requests to authenticate to the Internet, the receiving the message from the virtual switching instance in the virtual private local area network is: receiving from An access request message of the virtual switching instance in the virtual private local area network;

When the virtual switching instance from which the packet is sent is a member of the configured shared virtual switching instance, the shared virtual switching instance determines that the outbound interface corresponding to the packet is: in the shared virtual switching instance and all of the The member is configured to look up the MAC forwarding entry. If the outbound interface corresponding to the received access request packet exists in the MAC forwarding entry, the outbound interface is determined as the outbound interface corresponding to the access request packet.

If the MAC forwarding entry is the first packet or the forwarding entry is not found, the shared virtual switching instance and the interface corresponding to all member virtual switching instances except the virtual switching instance to which the user sending the packet belongs are The outbound interface corresponding to the access request packet is determined.

The method of claim 3, wherein, when the determined outbound interface is a QinQ interface, the forwarding, by the determined outbound interface, forwarding the packet to the destination end includes: using a default virtual local area network The tag performs QinQ encapsulation on the access request packet. The QinQ encapsulated access request packet is forwarded through the determined QinQ interface.

The method of claim 2, wherein when the user in the virtual private local area network requests to perform the three-layer access, the receiving the packet from the virtual switching instance in the virtual private local area network is: Receiving a data message from a virtual switching instance in the virtual private local area network;

When the virtual switching instance from the packet is a member of the configured shared virtual switching instance, the shared virtual switching instance determines that the outbound interface corresponding to the packet is: at least one Layer 3 logical interface to be pre-configured The MAC address corresponding to the data is determined to be an outbound interface corresponding to the data packet.

The method according to claim 5, wherein the packet is forwarded to the destination end by the determined outbound interface to: send the data packet to a layer 3 logical interface, and find a route. The table is forwarded.

The method according to claim 5 or 6, wherein the receiving the data packet from the virtual switching instance in the virtual private local area network further comprises the following steps:

Receiving an arp request message from the virtual switching instance in the virtual private local area network; checking whether the destination IP address of the arp request message is an IP address proxyed by the shared virtual switching instance,

If yes, the destination user MAC address is sent, and the arp response message including the MAC address of the Layer 3 logical interface as the search result is sent back, and the destination user MAC address of the data packet is notified to the user;

If not, if the destination IP address is the IP address of the Layer 3 logical interface, the arp response message including the MAC address of the Layer 3 logical interface is sent back, and the destination user MAC address of the data packet is notified to the user.

8. The method of claim 7 wherein said looking up a destination user MAC The step of the address includes: searching the member of the shared virtual switching instance and its configuration, if there is a MAC address of a layer 3 logical interface corresponding to the destination user IP address in the arp request packet, the MAC address is Address as the result of the search;

If there is no MAC address of the Layer 3 logical interface corresponding to the IP address of the destination user in the arp request packet, the arp request packet is sent to the shared virtual switch instance and the member virtual switch instance for searching.

Receiving an arp request message from the virtual switching instance in the virtual private local area network; when the destination IP address of the arp request message is an IP address of the Layer 3 logical interface, directly sending an arp response message, requesting the user to send the data Message.

A packet forwarding device for a virtual private local area network, comprising: at least one shared virtual switching instance configured with a plurality of members, the member being at least one virtual switching instance in the virtual private local area network;

The packet forwarding device according to claim 10, wherein the shared virtual switching instance includes at least one outgoing interface;

The outbound interface of the shared virtual switching instance forwards the packet to its destination.

The packet forwarding device according to claim 11, wherein the egress interface is connected to an access server;

When the packet received by the shared virtual switching instance is an access request packet for the user to request authentication, the shared virtual switching instance is connected to the access server by using the access server. The outbound interface forwards the access request packet.

13. The message forwarding device of claim 12, wherein:

The outbound interface connected to the access server is a QinQ interface, and the mapping between the virtual switch instance and the outer label is configured on the interface.

14. The message forwarding device of claim 12, wherein:

The outbound interface connected to the access server is a common interface, and the default outer label of the virtual switch instance user packet without the virtual local area network is configured on the interface.

15. The message forwarding device of claim 11, wherein:

The shared virtual switching instance is configured with at least one Layer 3 logical interface;

The Layer 3 logical interface is configured with an IP address and a MAC address that are in the same network segment as the requesting user of the virtual private local area network, and is used to forward data packets of the user of the virtual private local area network to perform Layer 3 access.

16. The message forwarding device of claim 15, wherein:

The shared virtual switching instance further includes: an arp proxy unit, configured to search for a MAC address of the three-layer logical interface that is the destination user MAC address according to the arp request packet of the user of the different virtual switching instance of the virtual private local area network.