AP registration method and apparatus, and related device
By obtaining and parsing LLDP information to determine the terminal type and issuing authentication-free VLAN configuration, the registration problem of AP when expanding capacity or migrating in the campus SDN network is solved, and the registration efficiency and simplification of configuration management is improved.
Patent Information
- Application Number
- CN202510080945.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-19
- Publication Date
- 2025-04-29
AI Technical Summary
In the SDN network of the campus, AP devices cannot be registered due to triggering authentication during capacity expansion or migration, and the configuration of the Access port is not dynamically issued with the change of terminal type, resulting in low configuration efficiency.
By obtaining the LLDP information of the target terminal, determining its terminal type. If it is an access point, an authentication-free VLAN configuration is issued to the target access device, and the terminal identification is issued to the authentication-free whitelist to realize automatic registration of the access point.
It solves the problem of registration failure caused by triggering authentication during AP expansion or migration, improves AP registration efficiency, simplifies configuration management, and realizes accurate and automated configuration of access points.
Smart Images
Figure CN119907091A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network communication technology, and in particular to an AP registration method, device and related equipment. Background Art
[0002] In the campus SDN (Software Defined Network) network, the Spine-Leaf-Access architecture model is adopted, in which the Spine core layer is responsible for policy routing and data forwarding. The Leaf device, as the aggregation layer, is responsible for wired / wireless user authentication, policy control, and service network gateway. The Access device layer provides access and location marking for directly connected wired users and wireless APs (Access Points).
[0003] Wireless AC and AP devices are responsible for the authentication and access of wireless terminals. APs are centrally controlled and managed through AC (Access Controller). All configurations are saved on the AC and issued by the AC. No configuration is required on the AP.
[0004] The terminals and APs in the park carry a large amount of data, requiring the AP devices to be quickly connected to the grid, efficiently deployed, and plug-and-play during network deployment, capacity expansion, or equipment migration. Summary of the invention
[0005] The present application provides an AP registration method, apparatus and related equipment.
[0006] In a first aspect, the present application provides an access point AP registration method, which is applied to a controller, and the method includes:
[0007] Obtain the subscribed link layer discovery protocol LLDP information of the target terminal published by the target access device, wherein an access device detects that a terminal is directly connected to the local interface and obtains the LLDP information of the terminal, and then publishes the LLDP information of the terminal;
[0008] Based on the LLDP information of the target terminal, determining the terminal type of the target terminal;
[0009] If the target terminal is determined to be an access point, the authentication-free virtual LAN VLAN configuration is sent to the target access device, and the terminal identifier of the target terminal is sent to the authentication device, so that the target access device configures the PVID of the downlink interface directly connected to the target terminal as the authentication-free VLAN. The authentication device adds the terminal identifier of the target terminal to the authentication-free whitelist. After receiving a registration message carrying the terminal identifier of the target terminal and the VLAN tag of the authentication-free VLAN, the authentication device forwards the registration message to the access controller AC.
[0010] Optionally, based on the LLDP information of the target terminal, the step of determining the terminal type of the target terminal includes:
[0011] Parsing the LLDP information of the target terminal to obtain a capability set of the target terminal;
[0012] According to the capability set of the target terminal, it is determined whether the target terminal is an access point.
[0013] Optionally, a feature fingerprint library of access points is maintained on the controller; if a capability set of a terminal matches any feature fingerprint in the feature fingerprint library, the terminal is determined to be an access point device;
[0014] The step of determining whether the target terminal is an access point according to the capability set of the target terminal includes:
[0015] Matching the capability set of the target terminal with each feature fingerprint in the feature fingerprint library;
[0016] It is determined whether the target terminal is an access point according to the matching result.
[0017] Optionally, the terminal identifier of the target terminal is a media access control MAC address of the target terminal.
[0018] In a second aspect, the present application provides an AP registration device, applied to a controller, the device comprising:
[0019] An acquisition unit is used to acquire the subscribed link layer discovery protocol LLDP information of the target terminal published by the target access device, wherein an access device detects that a terminal is directly connected to the local interface and obtains the LLDP information of the terminal, and then publishes the LLDP information of the terminal;
[0020] A determining unit, configured to determine a terminal type of the target terminal based on the LLDP information of the target terminal;
[0021] A sending unit, if the judgment unit determines that the target terminal is an access point, the sending unit is used to send the authentication-free virtual local area network VLAN configuration to the target access device, and send the terminal identifier of the target terminal to the authentication device, so that the target access device configures the PVID of the downlink interface directly connected to the target terminal as the authentication-free VLAN, the authentication device adds the terminal identifier of the target terminal to the authentication-free whitelist, and after receiving the registration message carrying the terminal identifier of the target terminal and the VLAN tag of the authentication-free VLAN, the authentication device forwards the registration message to the access controller AC.
[0022] Optionally, when judging the terminal type of the target terminal based on the LLDP information of the target terminal, the judging unit is specifically configured to:
[0023] Parsing the LLDP information of the target terminal to obtain a capability set of the target terminal;
[0024] According to the capability set of the target terminal, it is determined whether the target terminal is an access point.
[0025] Optionally, a feature fingerprint library of access points is maintained on the controller; if a capability set of a terminal matches any feature fingerprint in the feature fingerprint library, the terminal is determined to be an access point device;
[0026] When judging whether the target terminal is an access point according to the capability set of the target terminal, the judging unit is specifically configured to:
[0027] Matching the capability set of the target terminal with each feature fingerprint in the feature fingerprint library;
[0028] It is determined whether the target terminal is an access point according to the matching result.
[0029] Optionally, the terminal identifier of the target terminal is a media access control MAC address of the target terminal.
[0030] In a third aspect, an embodiment of the present application provides an AP registration device, the AP registration device comprising:
[0031] A memory for storing program instructions;
[0032] The processor is used to call the program instructions stored in the memory, and execute the steps of the method as described in any one of the first aspects above according to the obtained program instructions.
[0033] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method described in any one of the first aspects above.
[0034] In summary, the AP registration method provided in the embodiment of the present application obtains the subscribed link layer discovery protocol LLDP information of the target terminal published by the target access device, wherein an access device detects that a terminal is directly connected to the local interface and obtains the LLDP information of the terminal, and then publishes the LLDP information of the terminal; based on the LLDP information of the target terminal, the terminal type of the target terminal is judged; if the target terminal is determined to be an access point, the authentication-free virtual local area network VLAN configuration is issued to the target access device, and the terminal identifier of the target terminal is issued to the authentication device, so that the target access device configures the PVID of the downlink interface directly connected to the target terminal as the authentication-free VLAN, and the authentication device adds the terminal identifier of the target terminal to the authentication-free whitelist, and after receiving the registration message carrying the terminal identifier of the target terminal and the VLAN tag as the authentication-free VLAN, the authentication device forwards the registration message to the access controller AC.
[0035] The AP registration method provided in the embodiment of the present application is adopted to collect fingerprint feature databases to identify device types, and to accurately and automatically issue configurations to devices; the problem of registration failures caused by triggering authentication during the expansion and migration of campus APs is solved, and the AP registration efficiency is improved and configuration management is simplified. The type change of the terminal directly connected to the access port is identified, and the configuration of the port is automatically and accurately updated. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments of the present application or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present application.
[0037] Figure 1 A detailed flow chart of an AP registration method provided in an embodiment of the present application;
[0038] Figure 2 A schematic diagram of an AP registration implementation process provided in an embodiment of the present application;
[0039] Figure 3 A schematic diagram of the structure of an AP registration device provided in an embodiment of the present application;
[0040] Figure 4 A schematic diagram of the hardware architecture of another AP registration device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0041] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, rather than limiting the present application. The singular forms of "a", "said" and "the" used in the present application and claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to any or all possible combinations of one or more associated listed items.
[0042] It should be understood that, although the terms first, second, third, etc. may be used to describe various information in the embodiments of the present application, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, in addition, the word "if" used may be interpreted as "at..." or "when..." or "in response to determination".
[0043] At present, the SDN control component sends the initial VLAN to all downstream ports of Access in a "per-port per-VLAN" manner. The VLANs include the authentication VLAN for terminal online services and the free-VLAN (authentication-free VLAN) for AP online services. The default VLAN sent is the authentication VLAN, which is used for direct terminal authentication. By pre-defining the "AP direct port" on the SDN controller, the free-VLAN is sent to the designated port (for example, the downstream ports 1-10 of Access1 are AP direct ports, and the VLAN sent is the free-VLAN; the downstream ports 11-30 of Access1 are ports for direct terminal connections, and the VLAN sent is the authentication VLAN).
[0044] The AP registers with the wireless AC device through a specific wireless VLAN (using 4093 as an example). The complete process of AP registration is:
[0045] The AP initializes the DHCP client configuration, pre-configures PVID 4093 on the direct access port (AP direct port), and allows traffic with 4093 tag (label) to pass through the Leaf downstream port;
[0046] The AP obtains the IP address and the target AC device IP address from the VSI gateway mapped to 4093;
[0047] Actively establish a CAPWAP tunnel with the target AC to complete the registration.
[0048] However, in a network where authentication services have been deployed (downlink ports of Access), authentication will be triggered for new AP expansion and AP migration. The reason is that when the AP is connected to the Access device, the initial PVID of the Access port is not free-VLAN4093, but a VLAN that requires authentication (such as VLAN101). When the AP is powered on, the Access port carries a message of the authentication VLAN, and authentication is triggered on the Leaf downstream port. At this time, the AP is identified as a "PC terminal", triggering authentication and unable to continue to register with the wireless AC.
[0049] For the access port directly connected to the AP, the initial PVID of the port needs to be changed to free-VLAN before the AP is connected. In the campus, there are a large number of APs, the configuration efficiency is low, and there is no mechanism to automatically send free-VLAN configuration.
[0050] To summarize, in a campus network: when free-VLAN is not pre-configured, APs cannot be registered when expanding or migrating because authentication is triggered; in addition, the configuration of the AP directly connected to the Access port is not dynamically delivered as the terminal type changes.
[0051] For example, see Figure 1 FIG. 1 is a detailed flow chart of an AP registration method provided in an embodiment of the present application, and the method includes the following steps:
[0052] Step 100: Obtain the subscribed Link Layer Discovery Protocol LLDP information of the target terminal published by the target access device.
[0053] In the embodiment of the present application, an access device detects that a terminal is directly connected to a local interface and obtains the LLDP information of the terminal, and then publishes the LLDP information of the terminal.
[0054] In actual applications, the controller component subscribes to the LLDP information of the Access device. When a terminal directly connects to an Access device, it sends LLDP messages to the Access device it directly connects to. The Access device is configured with a subscription and publishing mechanism. After receiving the LLDP message sent by the new access terminal, the Access device will publish the LLDP message. The controller component subscribes to the LLDP message and obtains the LLDP message of the terminal subscribed by the Access device.
[0055] Step 110: Determine the terminal type of the target terminal based on the LLDP information of the target terminal.
[0056] In the embodiment of the present application, when determining the terminal type of the target terminal based on the LLDP information of the target terminal, a preferred implementation method is:
[0057] Parse the LLDP information of the target terminal to obtain a capability set of the target terminal; and determine whether the target terminal is an access point according to the capability set of the target terminal.
[0058] Specifically, the controller maintains a feature fingerprint library of access points; if a capability set of a terminal matches any feature fingerprint in the feature fingerprint library, the terminal is determined to be an access point device; then, when judging whether the target terminal is an access point according to the capability set of the target terminal, a preferred implementation method is:
[0059] Matching the capability set of the target terminal with each feature fingerprint in the feature fingerprint library; and determining whether the target terminal is an access point according to the matching result.
[0060] In the embodiment of the present application, the terminal identifier of the target terminal is a media access control MAC address of the target terminal.
[0061] Specifically, after the controller monitors the LLDP message from the Access device, it obtains the LLDP message, parses the LLDP message, and extracts the capability set TLV (Type-Length-Value) field, which includes the system capability, MAC address, and other information of the target terminal. Then, according to the system capability of the target terminal, the terminal type of the target terminal is determined. In the embodiment of the present application, to determine whether the target terminal is newly connected, a forwarding device (such as AP) registered on the access controller AC device is required.
[0062] In the embodiment of the present application, the administrator can maintain a feature fingerprint library on the controller in advance, and the feature fingerprint library includes multiple user-defined feature fingerprints that can characterize the target terminal that meets the feature fingerprint as a forwarding device that needs to be registered on the AC device. Then, after obtaining the capability set of the target terminal, the capability set includes the feature fingerprint, and the feature fingerprint is matched with each feature fingerprint in the feature fingerprint library. If any one of them matches, it is determined that the target terminal is a forwarding device (access point device) that needs to be registered on the AC device.
[0063] Furthermore, if the target terminal is determined to be a forwarding device that needs to be registered on the AC device, the name of the target terminal, the MAC address of the target terminal, the port identifier (index) directly connected to the target terminal on the Access device, the name of the direct connection port, etc. are output.
[0064] Step 120: If it is determined that the target terminal is an access point, the authentication-free virtual local area network VLAN configuration is sent to the target access device, and the terminal identification of the target terminal is sent to the authentication device.
[0065] In an embodiment of the present application, the controller sends an authentication-free virtual local area network VLAN configuration to the target access device, so that the target access device configures the PVID of the downlink interface directly connected to the target terminal as the authentication-free VLAN.
[0066] The controller sends the terminal identification of the target terminal to the authentication device so that the authentication device adds the terminal identification of the target terminal to the authentication-free whitelist. After receiving the registration message carrying the terminal identification of the target terminal and the VLAN tag being the authentication-free VLAN, the authentication device forwards the registration message to the access controller AC.
[0067] In an embodiment of the present application, when it is determined that the target terminal is an AP, Access is instructed to add the port directly connected to the target terminal to the authentication-free interface group. Specifically, the PVID of the port directly connected to the target terminal on Access is configured as free-VLAN (authentication-free VLAN). When the Access device subsequently receives a registration message sent by the target terminal, it will add a PVID tag to the registration message, that is, the registration message sent to the Leaf device carries the free-VLAN.
[0068] Furthermore, in order to ensure the security of the network, the MAC address needs to be authenticated, that is, the authentication device will release the registration message only when it determines that the MAC address of the terminal to be registered is a legal address.
[0069] In the embodiment of the present application, the controller will also send the MAC address of the target terminal to the authentication device, and the authentication device will add the MAC address of the target terminal to the authentication-free whitelist. In this way, the target terminal initiates a registration request. After the registration request message reaches the access device, the access device will add a free-VLAN tag to the registration message and forward it to the authentication device. After receiving the registration message, the authentication device determines that the registration message carries the MAC address of the target terminal and the VLAN tag is an authentication-free VLAN, and forwards the registration message to the access controller AC. In order to perform subsequent registration operations.
[0070] If the authentication device determines that the MAC address carried in the registration message is not in the authentication-free list, and / or the VLAN tag of the registration message is not free-VLAN, the connection is rejected and the authentication module initiates the authentication process.
[0071] In an embodiment of the present application, an aging time can also be set for each authentication-free entry (authentication-free MAC address entry) maintained on the authentication device. Then, when the MAC address entry corresponding to the free-MAC ages or the reported LLDP information ages (that is, the AP corresponding to the MAC address is not connected to the network), the free-MAC entry is cleared; in actual applications, manual deletion of the MAC entry will not delete the corresponding free-MAC entry.
[0072] The AP registration process provided by the embodiment of the present application is described in detail below in conjunction with specific application scenarios. Figure 2 , which is a schematic diagram of an AP registration implementation process provided in an embodiment of the present application;
[0073] The configuration is integrated into the existing SDN control component framework and implemented based on the following two modules. Module 1 collects data and matches rules and policies in module 2. This prevents the AP terminal from triggering authentication. At the same time, the control component dynamically sends free-VLAN successfully, and the AP can be registered with the AC device normally. Based on the above technology, efficient AP deployment can be achieved, manual maintenance costs can be reduced, and configuration and management can be simplified. The specific steps are as follows:
[0074] Module 1: Identification module. The SDN control component subscribes to the LLDP information of the access device. When the AP device accesses the access, the access device reports the LLDP information. The control component collects the capability set (Capability) of the neighboring device to build a device fingerprint library. If the device model is determined to be an AP device, its MAC address and direct port information are recorded in the storage module of the control component.
[0075] The specific implementation is as follows:
[0076] Initialize the subscription to LLDP information and send the subscription configuration to receive LLDP messages. Ensure that the device configuration allows the sending and receiving of LLDP information.
[0077] Listen to LLDP messages on the target network device and capture data in the topology monitoring module.
[0078] Parse LLDP messages and parse received LLDP packets. Extract capability set TLV (Type-Length-Value) fields: system capability, MAC address, etc.
[0079] Based on step c, the control component SNMP information builds a characteristic fingerprint library of wireless AP devices, and identifies the specific device type by matching the characteristic information in the fingerprint library. Parse the device type information according to the system description field. Use the system capability field to further confirm the device category.
[0080] Output the identification results. If it is an AP device, output the device name, MAC address, direct port index (port identifier), direct port name, and output ${free-mac} and ${port-index}.
[0081] The free-VLAN (VLAN 4093) is issued to the direct-connected port. According to the ${port-index} output in the previous step, it is automatically added to the AP direct-connected access interface group and the free-VLAN configuration is issued. The ${port-index} is updated when the network changes, and ports are dynamically added or deleted.
[0082] Module 2: Policy module, authentication-free policy based on MAC address. According to the output of module 1, splice the authentication-free policy. This policy develops a new instruction free-mac list${free-mac}, which matches the following authentication rules for devices (authentication devices) that enable free-mac, and automatically issues and deletes free-VLAN for ports based on the judgment results.
[0083] When an AP device attempts to connect to the network, it sends a registration message, and the authentication device (such as Leaf) checks the source MAC address of the registration message and the VLAN information of the registration message. If the source MAC address is in the free-mac table and the VLAN information is free-VLAN (authentication-free VLAN), it will be identified as a secure terminal by the authentication device and the authentication module will not be triggered.
[0084] If it is not in the free-mac table / the VLAN information is not a free-VLAN, the connection is rejected and the authentication module initiates the authentication process.
[0085] Further, calling module 1 listens to LLDP subscription information, and clears the free-mac entry when the mac address entry corresponding to free-mac ages or the reported LLDP information ages; in the embodiment of the present application, if the MAC entry is manually deleted, the free-mac entry will not be deleted.
[0086] For example, see Figure 3 FIG. 1 is a schematic diagram of a structure of an AP registration device provided in an embodiment of the present application. The device is applied to a controller and includes:
[0087] The acquisition unit 30 is used to acquire the subscribed link layer discovery protocol LLDP information of the target terminal published by the target access device, wherein an access device detects that a terminal is directly connected to the local interface and obtains the LLDP information of the terminal, and then publishes the LLDP information of the terminal;
[0088] A judging unit 31, configured to judge the terminal type of the target terminal based on the LLDP information of the target terminal;
[0089] The sending unit 32, if the judgment unit 31 determines that the target terminal is an access point, then the sending unit 32 is used to send the authentication-free virtual local area network VLAN configuration to the target access device, and send the terminal identifier of the target terminal to the authentication device, so that the target access device configures the PVID of the downlink interface directly connected to the target terminal as the authentication-free VLAN, the authentication device adds the terminal identifier of the target terminal to the authentication-free whitelist, and after receiving the registration message carrying the terminal identifier of the target terminal and the VLAN tag of the authentication-free VLAN, the authentication device forwards the registration message to the access controller AC.
[0090] Optionally, when judging the terminal type of the target terminal based on the LLDP information of the target terminal, the judging unit 31 is specifically configured to:
[0091] Parsing the LLDP information of the target terminal to obtain a capability set of the target terminal;
[0092] According to the capability set of the target terminal, it is determined whether the target terminal is an access point.
[0093] Optionally, a feature fingerprint library of access points is maintained on the controller; if a capability set of a terminal matches any feature fingerprint in the feature fingerprint library, the terminal is determined to be an access point device;
[0094] When judging whether the target terminal is an access point according to the capability set of the target terminal, the judging unit 31 is specifically configured to:
[0095] Matching the capability set of the target terminal with each feature fingerprint in the feature fingerprint library;
[0096] It is determined whether the target terminal is an access point according to the matching result.
[0097] Optionally, the terminal identifier of the target terminal is a media access control MAC address of the target terminal.
[0098] The above units may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA). For another example, when a certain unit is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these units may be integrated together and implemented in the form of a system-on-a-chip (SOC).
[0099] Further, the AP registration device provided in the embodiment of the present application, from the hardware level, the hardware architecture diagram of the AP registration device can be seen in Figure 4 As shown, the AP registration device may include: a memory 40 and a processor 41,
[0100] The memory 40 is used to store program instructions; the processor 41 calls the program instructions stored in the memory 40 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar and will not be repeated here.
[0101] Optionally, the present application also provides a controller, comprising at least one processing element (or chip) for executing the above method embodiment.
[0102] Optionally, the present application also provides a program product, such as a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the above method embodiments.
[0103] Here, the machine-readable storage medium may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (RadomAccess Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.
[0104] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.
[0105] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.
[0106] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.
[0107] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0108] Moreover, these computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0110] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.
Claims
1. A method for registering an access point AP, characterized in that: Applied to a controller, the method comprises: Obtain the subscribed link layer discovery protocol LLDP information of the target terminal published by the target access device, wherein an access device detects that a terminal is directly connected to the local interface and obtains the LLDP information of the terminal, and then publishes the LLDP information of the terminal; Based on the LLDP information of the target terminal, determining the terminal type of the target terminal; If the target terminal is determined to be an access point, the authentication-free virtual LAN VLAN configuration is sent to the target access device, and the terminal identifier of the target terminal is sent to the authentication device, so that the target access device configures the PVID of the downlink interface directly connected to the target terminal as the authentication-free VLAN. The authentication device adds the terminal identifier of the target terminal to the authentication-free whitelist. After receiving a registration message carrying the terminal identifier of the target terminal and the VLAN tag of the authentication-free VLAN, the authentication device forwards the registration message to the access controller AC.
2. The method according to claim 1, characterized in that Based on the LLDP information of the target terminal, the step of determining the terminal type of the target terminal includes: Parsing the LLDP information of the target terminal to obtain a capability set of the target terminal; According to the capability set of the target terminal, it is determined whether the target terminal is an access point.
3. The method according to claim 1, characterized in that The controller maintains a feature fingerprint library of access points; if a capability set of a terminal matches any feature fingerprint in the feature fingerprint library, the terminal is determined to be an access point device; The step of determining whether the target terminal is an access point according to the capability set of the target terminal includes: Matching the capability set of the target terminal with each feature fingerprint in the feature fingerprint library; It is determined whether the target terminal is an access point according to the matching result.
4. The method according to any one of claims 1 to 3, characterized in that: The terminal identifier of the target terminal is a media access control MAC address of the target terminal.
5. An AP registration device, characterized in that: Applied to a controller, the device comprises: An acquisition unit is used to acquire the subscribed link layer discovery protocol LLDP information of the target terminal published by the target access device, wherein an access device detects that a terminal is directly connected to the local interface and obtains the LLDP information of the terminal, and then publishes the LLDP information of the terminal; A determining unit, configured to determine a terminal type of the target terminal based on the LLDP information of the target terminal; A sending unit, if the judgment unit determines that the target terminal is an access point, the sending unit is used to send the authentication-free virtual local area network VLAN configuration to the target access device, and send the terminal identifier of the target terminal to the authentication device, so that the target access device configures the PVID of the downlink interface directly connected to the target terminal as the authentication-free VLAN, the authentication device adds the terminal identifier of the target terminal to the authentication-free whitelist, and after receiving the registration message carrying the terminal identifier of the target terminal and the VLAN tag of the authentication-free VLAN, the authentication device forwards the registration message to the access controller AC.
6. The device according to claim 5, characterized in that When determining the terminal type of the target terminal based on the LLDP information of the target terminal, the determining unit is specifically configured to: Parsing the LLDP information of the target terminal to obtain a capability set of the target terminal; According to the capability set of the target terminal, it is determined whether the target terminal is an access point.
7. The device according to claim 5, characterized in that The controller maintains a feature fingerprint library of access points; if a capability set of a terminal matches any feature fingerprint in the feature fingerprint library, the terminal is determined to be an access point device; When judging whether the target terminal is an access point according to the capability set of the target terminal, the judging unit is specifically configured to: Matching the capability set of the target terminal with each feature fingerprint in the feature fingerprint library; It is determined whether the target terminal is an access point according to the matching result.
8. The device according to any one of claims 5 to 7, characterized in that: The terminal identifier of the target terminal is a media access control MAC address of the target terminal.
9. An AP registration device, characterized in that: The AP registration device comprises: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps of the method according to any one of claims 1 to 4 according to the obtained program instructions.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method according to any one of claims 1 to 4.