WO2004095780A1

WO2004095780A1 - Network connection method, network connection system, layer 2 switch constituting the same, and management server

Info

Publication number: WO2004095780A1
Application number: PCT/JP2003/005199
Authority: WO
Inventors: Katsumi Shimada
Original assignee: Fujitsu Limited
Priority date: 2003-04-23
Filing date: 2003-04-23
Publication date: 2004-11-04
Also published as: JP3794496B2; JPWO2004095780A1

Abstract

A network connection method for mutually connecting a virtual LAN distributed to a plurality of sites via a network composed of a plurality of layer 2 switches. In order to constitute the virtual LAN distributed to a plurality of sites, a first virtual LAN constituting frame transmitted from the plurality of sites is monitored by the layer 2 switch of the network. According to the monitored first virtual LAN constituting frame, a virtual LAN identifier for the network is assigned. By using the layer 2 switch which has monitored the first virtual LAN constituting frame, a second virtual LAN constituting frame is generated according to the network virtual LAN identifier assigned and propagated to the plurality of layer 2 switches in the network so as to constitute the virtual LAN distributed to the plurality of sites. Thus, it is possible to effectively configure and operate the virtual LAN in the network of layer 2 switch according to a virtual LAN tag of a subscriber.

Description

Network connection method and network connection system and layer 2 switch and management server

The present invention relates to a network connection method, a network connection system, and a layer 2 switch and a management server constituting the network connection method, a network connection method for interconnecting virtual LANs distributed to a plurality of sites, and a network connection system. It relates to the layer 2 switch and management server to be configured. Background art

In recent years, as one type of private network service provided by service providers, one site belongs to another site belonging to the subscriber by using a layer 2 switch (hereinafter abbreviated as L2 switch) using a layer 2 MAC frame such as a subscriber LAN as it is. The service to transfer to is provided. Such services can handle protocols other than the IP protocol as compared to services based on layer 3 switches, and are expected to be widely used as general-purpose services in the future.

FIG. 1 shows a configuration diagram of an example of a conventional network connection system for providing such a service. In the figure, a service provider's network 10 is configured by an L2 switch group, for example, by a mesh or tree topology. Also, MAC frames may be encapsulated and transmitted by a network other than LAN such as ATM in the middle of the transmission path. To the network 10, sites 11, 12, 13 of subscriber A and sites 14, 15 of subscriber B are connected. Subscriber A's sites 11, 12, 13 are, for example, company A's Tokyo, Osaka, and Nagoya branches.

In this network 10, since the MAC frames of a plurality of subscribers A and B are transferred, it is necessary to identify the subscribers for each MAC frame and specify the transfer destination port. For this purpose, a unique virtual LAN (V LAN) 1 Arene Ne two rk (virtual LAN) A method of assigning and identifying a tag is used.

By the way, depending on the subscriber, there are cases where a plurality of VLAs are configured in the site (for example, a VLAN is configured for each organization in a company). FIG. 2 shows a configuration diagram of another example of such a conventional network connection system.

In this case, a VLAN tag is added to the MAC frame at the subscriber sites 11, 12, and 13, and the MAC frame must be transparently transferred through the service provider's network. At this time, the subscriber's VLAN tag is arbitrarily determined by the subscriber, and may overlap with the VLAN tag used by the service provider for transfer within the network 10.

The following methods are used to avoid this problem. That is, at the L2 switches 16, 17, and 18 at the edge (position connected to the subscriber side) in the network 10 provided by the service provider, as shown in the format of FIG. The VLAN tag 20 assigned by the subscriber in the MAC frame is left as it is, and a new VLAN tag 21 for transfer within the service provider network 10 is added.

For example, the VLAN tag 21 attached at the L2 switch 16 at the edge of the service provider is removed by the L2 switch 17 at the edge of the transfer destination site, and only the subscriber's own VLAN tag is sent to the subscriber side. MAC frame is transferred. Such a function of adding or removing a new VLAN tag to the L2 switch at the edge of the service provider is called VLAN tag stacking. The LAN switch and the terminal have the function of recognizing the GVRP (GARP VLAN) frame and the new protocol, respectively, and the GW (Gateway) of each terminal to determine the VLAN-ID to be assigned to each terminal As an ID identification method using an address, for example, there is a method described in Patent Document 1.

Patent Document 2 describes, for example, that MAC address learning of a LAN switch is performed for each VLAN.

Patent Document 1

JP 2002-26955 A Patent Document 2

JP 10-93614 A

Regarding the source MAC address and destination MAC address used in the L2 switch network 10, certain protocols may use a specific MAC address. For example, to use the VRRP (Protocol for Virtual Router) function described in RFC 2338, “00—00-5E-00-011-1 {VR ID}” is used as the MAC address. . Here, "VRIDj is variable and is one octet of information used to identify the router.

On the other hand, if a VLAN is configured in the network within the subscriber, the L2 switch can perform address learning independently for each VLAN (IEEE 802.1 (shown as “1 VL mode” in 1). Therefore, if the VLAN is divided, each VLAN operates using the same MAC address such as “00-00-5 E-00-011-1” as the MAC address of VRRP. It becomes weightable.

In other words, even if the networks are physically connected to each other, an arbitrary MAC address can be assigned to each of the VLANs if the VLANs are distributed. Other than VRRP, for example, when using a local MAC address, the same MAC address may be used in a different VLAN.

However, when a plurality of VLANs of such a subscriber are connected via the service provider network 10, the following problem occurs when the configuration shown in FIG. 4 is adopted.

Since the service provider's network 10 is composed of L2 switches 16, 17, etc., MAC address learning is performed at the edge L2 switch for each provider's VLAN tag assigned by the VLAN tag stacking function. Therefore, learning for each VLAN tag of the subscriber is not performed.

Therefore, as the MAC address of the subscriber's node, “00—00—5E—00-01-01J may come from Site 11 in Tokyo, or Site 12 in Osaka, and communication may not be performed properly. For example, from Site 11 in Tokyo to “00—00—5E—00—01—01” on VLAN 201 (Osaka (Existing at site 12), but at that time VLAN 301 "00-1 00-5E-00-01-01-01" may have been learned at L2 switch 16 so that it exists at site 11 in Tokyo. Since the frame is filtered when it is sent from the node at site 11 in Tokyo to the L2 switch 16 at the edge of the gateway, the communication is not possible.

To solve this problem, it is conceivable to learn the MAC address including the VLAN tag of the subscriber at the L2 switch in the provider's network. Normally, L2 switches use CAM (Contet Add ressable Memory) to speed up address learning and retrieval of learning results.However, to learn including the VLAN tag of the subscriber, MAC Since 48 bits of address and 12 bits of VLAN tag are aligned, a total of 72 bits of address space is required. Using a CAM with such a function will increase the cost of equipment. In addition, a special L 2 switch is required, which is expensive compared to a general L 2 switch.

Another solution is to assign a different VLAN-ID (hereinafter abbreviated as “VID”) to the provider's VLAN tag according to the value of the subscriber's VLAN tag. That is, at the L2 switch at the edge of the provider, the VID in the provider's network is found based on the value of the VLAN tag of the frame flowing in from the B input user, and the VLAN tag is used as a VLAN tag stacker. Added by tucking function.

As a result, address learning in the L2 switch of the provider is performed independently for each VID corresponding to each of the different VLANs on the subscriber side, so that the above-described problem can be solved. However, for this, every time a subscriber adds or deletes a VLAN configuration, it is necessary to change the setting for assigning a VLAN tag to the provider, and the network needs to be changed. There was a problem that a lot of labor for management was required. Disclosure of the invention

The present invention provides a network of a layer 2 switch according to a subscriber's virtual LAN tag. It is a general purpose to provide a network connection method, a network connection system, and a layer 2 switch and a management server that constitute the network connection method and the network connection system that can efficiently perform the configuration and operation of a virtual LAN.

In order to achieve this object, the present invention provides a network connection method for interconnecting virtual LANs distributed over a plurality of sites via a network composed of a plurality of layer 2 switches, The first virtual lan configuration frame transmitted from the plurality of sites to form a distributed virtual lan is monitored by a layer 2 switch of the network, and the monitored first virtual lan configuration frame is monitored. A virtual LAN identifier for network is allocated based on the virtual LAN identifier for network, and the second virtual LAN configuration frame is allocated based on the allocated network virtual identifier for network by the layer 2 switch that monitors the first virtual LAN configuration frame. The virtual LAN is generated and propagated to a plurality of layer 2 switches in the network to form a virtual LAN distributed to the plurality of sites.

According to such a network connection method, the configuration and operation of the virtual LAN in the network of the layer 2 switch can be efficiently performed according to the virtual LAN tag of the subscriber. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a configuration diagram of an example of a conventional network connection system.

FIG. 2 is a configuration diagram of another example of the conventional network connection system.

FIG. 3 is a diagram showing the format of a MAC frame for stacking V lan tags.

FIG. 4 is a network configuration diagram for explaining a conventional technique.

FIG. 5 is a configuration diagram of one embodiment of the network connection system of the present invention. FIG. 6 is a diagram showing the format of a GVRP frame.

FIG. 7 is a flowchart of a process executed when a GVRP frame is received from a subscriber on the L2 switch.

FIG. 8 is a flowchart of a process executed when the management server receives a frame from the L2 switch. FIG. 9 is a flowchart of a process executed when a response from the management server is received by the L2 switch.

FIG. 10 is a diagram showing a table A for subscribers and a table B for management of allocated VIDs.

FIG. 11 is a diagram showing bit map data.

FIG. 12 is a diagram showing a table C of the L2 switch.

Fig. 13 is a flowchart when the configuration of the VLAN of each L2 switch is set online from the management server. BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 5 shows a configuration diagram of an embodiment of the network connection system of the present invention. In the figure, the same parts as those in FIGS. 2 and 4 are denoted by the same reference numerals. In FIG. 5, a service provider network 10 is configured by an L2 switch group, for example, by a mesh topology. In addition, MAC frames may be encapsulated and transmitted by a network other than LAN such as ATM in the middle of the transmission path. The network 10 is connected to the sites 11 and 12 of the subscriber A, and the management server 30 is connected.

To configure a VLAN in the network 10 composed of L2 switches, it is necessary to set in advance which VLAN belongs to each port of each L2 switch, and according to the setting, the L2 switch is set. Selects the port to forward the MAC frame to.

If the network administrator manually sets the VLAN on each such L2 switch, it takes a lot of work and may cause a mistake in the setting.Therefore, GVRP (GARP A method for automatically configuring a VLAN by VLAN registration (Protocol) is shown. Note that GARP (Generic Attribut Reg registr on Prtotco oll) is specified in IEEE 802.1p.

According to GVRP, a subscriber manually sends a VL to a terminal or an L2 switch connected to the terminal. By setting the AN, the L2 switch sends VLAN configuration information to adjacent L2 switches in the network in a message, and eventually the VLAN information is automatically propagated to all L2 switches As a result, the VLAN configuration is set for the entire network of the L2 switch.

In the network connection system of the present invention, the VLAN in the provider's network is automatically configured using GVRP used for configuring the VLAN on the subscriber side.

First, if subscriber A's multiple VLANs (VLAN 201, VLAN 301) are composed of multiple sites 11 and 12, L2 switches 31 and 32 of Caro's A site 11 and 12 are subscribers. A GVRP frame for constructing the V LAN in sites A and 12 of A is sent out to other sites. This is a function that has already been realized if the L2 switch has a VLAN function. At this time, it is assumed that one VLAN (VLAN 100) connecting each of the sites 11 and 12 of the subscriber A is configured in advance in the network 10 of the provider.

The L2 switches 33 and 34 at the edge of the provider monitor the GVRP frame, acquire the VID used by the power source B, and use the VID to centrally manage the VLANs in the network 10 of the provider. Send to the management server 30. The management server 30 checks whether a new VID is being used by the subscriber A, and if it detects that the new VID is being used, the management server 30 responds accordingly to one of the services used in the provider's network. A VID is assigned, and an instruction to configure a VLAN and the assigned VID are sent as a message to the L2 switches 33 and 34 at the edge.

Upon receiving the message, the L2 switches 33 and 34 generate a GVRP frame based on the VID notified from the management server 30, and the adjacent L2 switches 35, 36, 37 and 38 in the provider's network 10. Send to This automatically configures the VLAN in the provider's network 10.

The edge L2 switches 33 and 34 have the above-described VLAN tag stacking function. As a result, the VLA that refers to the VLAN tag that flows in from the subscriber and has the tag of the VID used in the provider 10 corresponding to that value Stacks N tags and sends them out to network 1◦. As a result, transfer and address learning according to the VLAN can be performed within the network 10.

Similarly, the L2 switches 33 and 34 at the edge also stack the VLAN tag on the GVRP frame from the subscriber side and transmit it to the network 10. This makes it possible to distinguish from GVRP frames without VLAN tags used in the network 10, and to transparently transfer GVRP frames from subscribers. '

Instead of propagating the GVRP frame within the provider's network 10, the management server 30 sends a command message for configuring a VLAN to the L2 switch in the network 10 online, by sending it online. However, it is possible to automatically configure the VLAN in the network.

The network connection system of the present invention will be described in more detail.

In FIG. 5, one VLAN (VLAN 100) is set in advance in the L2 switches 33 to 36 in the provider. This is used to transfer GVRP frames from sites 11 and 12 of subscriber A at sites 11 and 12. It is also used to transfer MAC frames that do not belong to a specific VLAN. The management server 30 is a device for operating and maintaining the network 10 of the provider, and performs various settings for the L2 switch configuring the network 10. For example, it has a function to centrally manage VIDs used in the network 10 and to set two switches each.

When a new VLAN is defined for site A of subscriber A, a GVRP frame is transmitted from port 900 of L2 switch 31 in site 11 of caro A. FIG. 6 shows the format of a GVRP frame. In the figure, the GVRP frame is composed of the destination MAC address, source MAC address, control information, attribute event, VLAN tag (VLAN-ID), and FCS. The attribute event indicates a command such as "JoinJ ^^ FLe a v eJ" for instructing addition or deletion of a VID to configure a VLAN in the LAN.

FIG. 7 shows a flowchart of a process executed when a GVRP frame from a subscriber is received by an L2 switch in the network. In the figure, in step S1-1, The L2 switch 33 at the edge of the provider can recognize and recognize the GVRP frame by checking whether the destination address of the MAC frame from the subscriber A is equal to the MAC address determined by the GVR P frame.

Next, in step S1-2, this MAC frame is transmitted to each of the subscriber's sites 12 using the preset VLAN100. At this time, a VLAN tag is inserted to identify the GVR P frame sent from the subscriber. Since the GVR P frame transmitted to configure the VLAN in the provider's network 10 does not have a VLAN tag, the GVR P frame of the subscriber (the first virtual LAN configuration described in the claims) can be obtained. And the GVR P frame of the provider's network 10 內 (the second virtual LAN configuration frame described in the claims).

In step S1-3, the attribute value in the GVR P frame is continuously extracted, and the information is transmitted to the management server 30. At this time, based on the information for identifying the subscriber, • The initially set V LAN 100 and the receiving port a 00 are also transmitted.

FIG. 8 is a flowchart of a process executed when the management server receives a frame from the L2 switch. In the figure, in step S2-1, the management server 30 checks whether the GVR P frame from the subscriber is "Join" or "LeaVe" based on the received information. In the case of J inn, in step S2-2, it is determined whether or not the subscriber's VID is already associated with the VID in the provider's network 10 based on the received information.

This is performed, for example, by searching the subscriber table A and the assigned VID management table B shown in FIG. Table A contains the maximum number of VIDs allowed by contract, the number of assigned VIDs, and the pointers to the assigned VID management table for each subscriber's default VLAN, and Table B contains the subscribers. A provider VID (virtual LAN identifier for network described in the claim) is set for each VID (virtual LAN identifier for subscriber described in the claim).

That is, a pointer from table A to table B is obtained, and the subscriber VID of table B is searched to check whether the subscriber VID has already been registered and corresponded to the provider VID. If the result is already assigned, no new assignment is needed There, it ends.

Here, if no VID is assigned, a new VID must be assigned.However, since there is an upper limit to the number of VIDs that can be used in the provider's network, it is not possible to assign an unlimited number of VIDs to one subscriber. Not desirable. For this reason, the number of VIDs that can be used in the provider's network according to the contract with the subscriber is set in advance as the maximum allowable VID number for the table A. In step S2-3, the maximum allowable number of VIDs is compared with the number of currently allocated VIDs.

If the comparison results in a match, no new assignment is made and an alarm is displayed in step S2-4 to inform the network 10 administrator. As a result, the operator of the network 10 can notify the caro input user that the request for a new VID cannot be accepted.

If they do not match, a new VID is allocated in step S2-5. For this purpose, for example, the bitmap data shown in FIG. 11 is used. In this bitmap data, one bit corresponds to V ID = 0 to y ID = 405 in order. If the bit is 0, it indicates that the V ID has already been assigned. Therefore, an unused V ID can be obtained by searching this bitmap data. When the VID to be assigned is determined, the subscriber's VID and the assigned VID are set in Table B in step S2-6. Also, the LID switch 33 is notified of the VID to be allocated in step S2-7. At this time, information indicating “assigned” and information for specifying the subscriber (V LAN 100, port a 00) are also added.

If the GVR P frame from the subscriber is Lea Ve in step S2-1, in step S2-9, based on the received information, the subscriber's information and VID are already in the provider's network. Check if it is associated with the VID.

If the V ID is associated, the V ID is made empty in step S2-10. This is performed by setting the bit corresponding to the bitmap data shown in FIG. 11 to “0”. In step S2-11, the subscriber VID and the assigned VID are also deleted from table B.

Then, in step S2-12, the deleted VID is notified to the L2 switch 33. At this time, information indicating "deleted" and information for identifying the subscriber (VL AN 100, port a 0) also burns.

FIG. 9 shows a flowchart of a process executed when a response from the management server is received by the L2 switch. In the figure, in step S3-1, the L2 switch (for example, L2 switch 33) checks whether it is "allocated" or "deleted" based on the information received from the management server 30.

• If it is “assigned”, in step S 3-2, a GVRP frame is created based on the returned information, and sent as an event “Jo in” to the adjacent L 2 switch in the network 10. This GVRP frame is transmitted periodically since there is a possibility that it will be discarded in the network if it is transmitted only once.

At the adjacent L2 switch, since there is no VLAN tag in the GVR P frame, it can be understood that the GVR P frame is a GVR P frame for configuring the VLAN in the network 10, and the information in the device is set based on the information. And transfer to the adjacent L2 switch. At this time, the L2 switches 33 and 34 at the edge discard the GVR P frame because there is no need to send it to the subscriber. In this way, the configuration of the V LAN in the network 10 is automatically set.

Next, in step S3-3, the L2 switch adds the notified VID to the table C shown in FIG. 12 based on the information notified from the management server 30. Table C contains a flag indicating whether or not the provider VID has been set for the subscriber VID at each of the table relative positions 0 to 495 corresponding to the caro input VIDs 0 to 495. 1: set, 0: unset), and the provider's VID value is set.

When a MAC frame with a VLAN tag is received from a subscriber, the VID to be used in the provider network 10 is obtained by referring to this table C using the subscriber VID, and the VID of the provider is obtained. It is possible to add (stack) a VLAN tag with a tag and send it out to the network 10. The format of the MAC frame at this time is as shown in FIG.

Within the provider's network 10, via the VLAN automatically configured by the GVR P frame, it reaches the edge L2 switch (for example, L2 switch 34) connected to the subscriber's site I do. At the edge L2 switch 34, the VLAN tag attached with the L2 switch SW33 is removed and sent to the subscriber. The MAC frame is transmitted transparently to the subscriber.

On the other hand, if “deleted” in step S3-1, step S3-4 deletes the VID at the corresponding setting position in table C shown in Fig. 12 based on the information returned in step S3-4. . Next, in step S3-5, a GVRP frame is created based on the responded information, and transmitted as a “Leave” message to an adjacent L2 switch in the network 10. Since this frame may be discarded in the network 10 if it is transmitted only once, it is transmitted periodically. As a result, the target VID is automatically deleted from the VLAN in the network 10.

Further, as another embodiment, FIG. 13 shows a flowchart when the configuration of the VLAN of each L2 switch is set online from the management server without using the GVR P for the VLAN configuration in the network 10. In this embodiment, the function of the L2 switch generating the GVRP frame based on the VID returned from the server becomes unnecessary.

In FIG. 13, in step S4-0, the management server 30 executes the same processing as steps S2-2 and S2-7. Then, in step S4-1, an instruction message for VLAN configuration is sent to each L2 switch in the network 10. In order to send this instruction, the route can be known based on the information of VLAN 100 originally set for this subscriber, and it is as if GVR P is propagated through the route. Similarly, it is possible to send an instruction message to each L2 switch.

The L2 switch that has received the instruction message for the VLAN configuration adds the notified VID to the table C shown in FIG.

In the same manner, the VID can be deleted by changing the content of the instruction message from the management server. As described above, according to this embodiment, the VLAN configuration is automatically set. can do.

As described above, according to the present invention, a plurality of VLANs are configured in a certain subscriber's network, and the plurality of VLANs are configured in a plurality of sites via an L2 switch network. Even if the same MAC address is used, in the provider's network 10, the customer's VLA Since different values of VLAN are configured corresponding to N, the address learning of the MAC frame of the subscriber can be learned as different values of VLAN in the provider network 10 as well. The service of C frame relay is provided without any problem.

Also, even if the configuration of the VLAN is arbitrarily changed on the subscriber side, the VLAN in the network 10 can be automatically configured by the GV RP frame sent from the subscriber side. The management work for the operation of is reduced.

As described above, according to the first and third aspects of the present invention, the configuration and operation of the virtual LAN in the layer 2 switch network can be efficiently performed according to the subscriber's virtual LAN tag. .

Further, according to the inventions set forth in claims 2 and 4, the configuration and operation of the virtual LAN in the layer 2 switch network can be efficiently performed according to the virtual LAN tag of the subscriber.

Steps S1-1-1 to S1-3 correspond to the monitoring means described in the claims, steps S2-1-1 to S2-7 correspond to the assigning means, and steps S3-1-1 to S3 —3 corresponds to the generating means, step S4-1 corresponds to the indicating means, tables A and B correspond to the first table, and table C corresponds to the second table.

Claims

The scope of the claims

1. In a network connection method for connecting virtual LANs distributed to a plurality of sites to each other via a network configured by a plurality of layer 2 switches, the network connection method includes the steps of: The first virtual LAN configuration frames transmitted from a plurality of sites are monitored on the layer 2 switch of the network,

A virtual LAN identifier for network is assigned based on the monitored first virtual LAN configuration frame,

A layer 2 switch that monitors the first virtual lan configuration frame generates a second virtual lan configuration frame based on the assigned network virtual lan identifier and generates a plurality of layers 2 in the network. A network connection method _σ that propagates through a switch and configures a virtual LAN distributed over the plurality of sites.

2. In a network connection method in which virtual LANs distributed to a plurality of sites are interconnected via a network configured by a plurality of layer 2 switches, in order to configure virtual LANs distributed to the plurality of sites, The first virtual LAN configuration frame transmitted from the plurality of sites is monitored by a layer 2 switch of the network,

A network connection method for instructing a plurality of layer 2 switches in the network to configure a virtual lan using the allocated network virtual lan identifier and configuring a virtual lan distributed to the plurality of sites.

3. In a network connection system that interconnects virtual LANs distributed to multiple sites via a network composed of multiple layer 2 switches,

を The first virtual lan configuration frame transmitted from the plurality of sites to form a virtual lan distributed to the plurality of sites is transmitted to the layer 2 switch of the network. Monitor means for monitoring with a switch,

Allocating means for allocating a network virtual LAN identifier and an IJ child based on the monitored first virtual LAN configuration frame;

Generating means for generating a second virtual lan configuration frame on the basis of the assigned network virtual lan identifier by a layer 2 switch monitoring the first virtual lan configuration frame;

A network connection system that propagates the second virtual lan configuration frame generated by the generation means to a plurality of layer 2 switches of the network and forms a virtual lan distributed to the plurality of sites.

4. In a network connection system that interconnects virtual LANs distributed to multiple sites via a network composed of multiple layer 2 switches, in order to configure virtual LANs distributed to the multiple sites Monitoring means for monitoring a first virtual LAN configuration frame transmitted from the plurality of sites on a layer 2 switch of the network;

Allocating means for allocating a network virtual LAN identifier based on the monitored first virtual lan configuration frame;

Instructing means for instructing a plurality of Layer 2 switches in the network to configure a virtual LAN using the assigned network virtual LAN identifier, and distributed to the plurality of sites by an instruction of the instructing means. A network connection system that constitutes a virtual LAN.

5. The network connection system according to claim 3, wherein the allocating means includes a subscriber virtual LAN identifier set in the monitored first virtual LAN configuration frame and the network virtual LAN identifier. A network connection system having a first table for managing identifiers in association with each other.

6. Layer 2 of a network connection system that connects virtual LANs distributed at multiple sites to each other via a network composed of multiple layer 2 switches A switch,

Monitoring means for monitoring a first virtual lan configuration frame transmitted from the plurality of sites to configure a virtual lan distributed to the plurality of sites; and Generating means for generating a second virtual lan configuration frame based on the allocated network virtual lan identifier based on the allocated network virtual lan identifier based on the frame;

The second virtual LAN configuration frame generated by the generation means is propagated to another adjacent layer 2 switch in the network.

7. A management server for a network connection system that connects virtual LANs distributed over multiple sites to each other via a network composed of multiple layer 2 switches,

A layer for allocating a network virtual LAN identifier based on the first virtual lan configuration frame transmitted from the plurality of sites monitored by the layer 2 switch of the network, and monitoring the network virtual lan configuration frame A management server having an assignment means for notifying two switches.

8. A management server for a network connection system that interconnects virtual LANs distributed over multiple sites via a network composed of multiple layer 2 switches,

Allocating means for allocating a virtual LAN identifier for a network based on a first ίcontemplating RAN configuration frame transmitted from the plurality of sites monitored by a layer 2 switch of the network;

A management server having an instruction means for instructing a layer 2 switch of a path of the first virtual lan configuration frame in the network to set the virtual lan identifier for the network.

9. In the management server according to claim 7 or 8,

The allocating means is set in the monitored first virtual LAN configuration frame. A management server having a first table for managing the associated subscriber virtual LAN identifier and the network virtual LAN identifier.

10. The layer 2 switch according to claim 6,

The generating means includes a subscriber virtual LAN identifier set in the monitored first virtual LAN configuration frame and a network virtual LAN identifier notified from a management server of the network connection system. Layer 2 switch with a second table that is managed in correspondence.