A configuration method, device, SDN controller, and medium of a security entry

Abstract

Embodiments of the present invention provide a security entry configuration method, device, SDN controller and medium, and relate to the technical field of communications. The embodiment of the present application includes: collecting the DHCP Snooping entry, the ARP Snooping entry and the WLAN Snooping entry of each AP in the controlled network topology; according to the collected DHCP Snooping entry, ARP Snooping entry and WLAN Snooping The table item generates a security table item; receives the information of the terminal to be bound, and statically binds the security table item of each terminal to be bound to the switch or AP connected by the terminal to be bound, so that the switch and AP in the network topology are based on the static The bound security entry performs packet filtering. On the premise of ensuring terminal access security, the configuration workload can be reduced and configuration efficiency can be improved.

Description

technical field [0001] The present invention relates to the field of communication technologies, in particular to a configuration method and device, an SDN controller and a medium of a security entry. Background technique [0002] Network security is very important to the network of every enterprise. At present, there are some small-scale outlets, such as small-scale business outlets in the financial industry, outlets in the retail industry, etc., which have the characteristics of small network scale and small number of access users. And each small-scale network also needs to communicate with the headquarters, which is responsible for deployment and management. [0003] This kind of massive small branch network is suitable for management through the software defined network (Software Defined Network, SDN) controller. The network administrator does not need to be familiar with the configuration method of each network device. Batches of network configurations are delivered to...

AI Technical Summary

Problems solved by technology

However, there will inevitably be some terminals using static IP addresses in the network, and the packets carrying static IP addresses cannot be effectively filtered through the IP Source Guard function.

[0005] If you manually configure the binding entries of terminals using static IP addresses for each interface, you need to configure the interfaces in the branch network one by one, which requires a lot of configuration work and low efficiency.

If the SDN controller is used to implement branch network deployment, the administrator needs to collect static IP addresses and Media Access Control (MAC) addresses. Once the administrator enters the wrong IP address and MAC address, the terminal cannot be connected normally. access to the network, or cannot effectively filter packets, the security of terminal access cannot be guaranteed

Images