Authentication table item issuing method and device and related equipment

Abstract

The invention relates to the technical field of network communication, in particular to an authentication table item issuing method and device and related equipment. The method is applied to a first cross-device link aggregation (M-LAG) device in a network, the M-LAG device is an authentication point (NAS) device in the network, and the method comprises the following steps: receiving a first authentication table item of successful authentication of a first user terminal sent by a second M-LAG device, after the second M-LAG device receives a message that the first user terminal is successfully authenticated sent by an authentication server, the first authentication table item is generated based on the message that the first user terminal is successfully authenticated; the first authentication table item is marked to be in an inactive state, and when one authentication table item is marked to be in the inactive state, the authentication table item is not issued to hardware resources.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a method, device and related equipment for issuing authentication items. Background Art

[0002] M-LAG (Multichassis link aggregation) virtualizes two physical devices into one device at the aggregation level to achieve cross-device link aggregation, thereby providing device-level redundancy protection and traffic load sharing. For example, Device A and Device B form a load sharing and forward traffic together. When one of the devices fails, the traffic can be quickly switched to the other device to ensure the normal operation of the business.

[0003] Currently, M-LAG authentication modes for user terminals include: centralized processing mode and distributed processing mode.

[0004] Among them, in the centralized processing mode:

[0005] If the master device receives a user message, it will be processed directly on the master device. If the backup device receives a user message, it will first perform necessary message parsing, then notify the master device for subsequent processing, and the master device will actively interact with the AAA server and client for authentication-related messages. In this mode, the configuration is relatively simple. Only one access device IP needs to be managed on the RADIUS server, and only one identical RADIUS message source IP address needs to be configured on the two M-LAG devices. However, the distribution efficiency of user messages is low, which is suitable for scenarios with a small number of access users. In addition, the messages can only be processed on the master device of the M-LAG. The risk of single point failure is high, and high availability cannot be truly achieved.

[0006] In distributed processing mode:

[0007] Local mode: User packets sent by the local M-LAG interface are processed by the local M-LAG device.

[0008] Even-odd mode: When the host receives a user message, it parses the user source MAC in the message and processes the odd MAC on one M-LAG device and the even MAC on another M-LAG device according to the port security configuration. If the peer needs to process it, it is transparently transmitted to the peer for processing.

[0009] In the distributed processing mode, the distribution efficiency of user messages is high, but the RADIUS server needs to manage two access device IPs. The two M-LAG devices need to configure the RADIUS message source IP addresses used by the local device and the peer device at the same time. This is suitable for scenarios with a large number of centralized online users. Among them, the local mode has the highest distribution efficiency, followed by the parity mode. In the campus M-LAG access authentication network, the parity mode of distributed processing is generally used. However, in the parity mode of distributed processing, half of the Inactive entries will exist on both the master and slave devices. Under normal circumstances of the M-LAG system, half of the device access resources will be wasted. Summary of the invention

[0010] The present application provides a method, device and related equipment for issuing authentication items, so as to solve the problem of hardware resource waste existing in the related technology.

[0011] In a first aspect, the present application provides a method for issuing an authentication entry, which is applied to a first inter-device link aggregation M-LAG device in a network, wherein the M-LAG device is an authentication point NAS device in the network, and the method includes:

[0012] Receiving a first authentication entry of a first user terminal successful authentication sent by a second M-LAG device, wherein the second M-LAG device generates the first authentication entry based on the message of the first user terminal successful authentication after receiving a message of the first user terminal successful authentication sent by an authentication server;

[0013] The first authentication entry is marked as an inactive state, wherein when an authentication entry is marked as an inactive state, the authentication entry is not sent to the hardware resource.

[0014] Optionally, the method further comprises:

[0015] receiving an access authentication request sent by a second user terminal, and sending the access authentication request to an authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request;

[0016] Receiving a message from the authentication server indicating that the second user terminal has been successfully authenticated;

[0017] Generate a second authentication entry of successful authentication of the second user terminal based on the message of successful authentication of the second user terminal;

[0018] The second authentication entry is marked as active, and the second authentication entry is sent to the hardware resource.

[0019] Optionally, the method further comprises:

[0020] The second authentication entry is sent to the second M-LAG device, so that the second M-LAG device marks the second authentication entry as inactive.

[0021] Optionally, the method further comprises:

[0022] Receiving an authentication request sent by a third user terminal;

[0023] If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed locally, the authentication request sent by the third user terminal is sent to the authentication server for access authentication processing;

[0024] If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed by the second M-LAG device, the authentication request sent by the third user terminal is transparently transmitted to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to the authentication server for access authentication processing.

[0025] Optionally, the method further comprises:

[0026] When a failure of the second M-LAG device is detected, determining whether the sum of the number of authentication entries in the active state and the number of authentication entries in the inactive state maintained locally is greater than a single device authentication specification of local hardware resources;

[0027] If it is determined that the sum of the number of authentication items is greater than the single-device authentication specification of the local hardware resource, a number of target authentication items that meet the preset conditions are determined from the inactive authentication items, wherein the number of target authentication items is the difference between the sum of the number of authentication items and the single-device authentication specification of the local hardware resource;

[0028] For each target authentication entry, obtain the user access VLAN corresponding to the target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as the user access VLAN without authentication, so that when the user's traffic message is received through the authentication interface, the user's traffic message is forwarded based on the mapping relationship between the user access VLAN corresponding to the target authentication entry and the VXLAN.

[0029] In a second aspect, the present application provides an authentication entry issuing device, which is applied to a first inter-device link aggregation M-LAG device in a network, wherein the M-LAG device is an authentication point NAS device in the network, and the device includes:

[0030] A receiving unit, configured to receive a first authentication entry of a first user terminal successfully authenticated, sent by a second M-LAG device, wherein the second M-LAG device generates the first authentication entry based on the message of successful authentication of the first user terminal after receiving a message of successful authentication of the first user terminal sent by an authentication server;

[0031] The marking unit is used to mark the first authentication entry as an inactive state, wherein when an authentication entry is marked as an inactive state, the authentication entry is not sent to the hardware resource.

[0032] Optionally, the device further includes a sending unit, a generating unit and a sending unit:

[0033] The receiving unit is further configured to receive an access authentication request sent by a second user terminal;

[0034] The sending unit is used to send the access authentication request to the authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request;

[0035] The receiving unit is further configured to receive a message sent by the authentication server indicating that the second user terminal has been successfully authenticated;

[0036] The generating unit is used to generate a second authentication entry of successful authentication of the second user terminal based on the message of successful authentication of the second user terminal;

[0037] The marking unit is further used to mark the second authentication entry as active;

[0038] The sending unit is used to send the second authentication table entry to the hardware resource.

[0039] Optionally, the sending unit is further configured to send the second authentication entry to the second M-LAG device, so that the second M-LAG device marks the second authentication entry as inactive.

[0040] Optionally, the receiving unit is further configured to receive an authentication request sent by a third user terminal;

[0041] If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed locally, the sending unit is further used to send the authentication request sent by the third user terminal to the authentication server for access authentication processing;

[0042] If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed by the second M-LAG device, the sending unit is also used to transparently transmit the authentication request sent by the third user terminal to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to the authentication server for access authentication processing.

[0043] Optionally, the device further comprises:

[0044] A judgment unit, when a failure of the second M-LAG device is detected, the judgment unit is used to judge whether the sum of the number of authentication items in the active state and the number of authentication items in the inactive state maintained locally is greater than the single device authentication specification of the local hardware resources;

[0045] A determination unit, wherein if the determination unit determines that the sum of the number of authentication items is greater than the single-device authentication specification of the local hardware resource, the determination unit is used to determine a number of target authentication items that meet a preset condition from the inactive authentication items, wherein the number of the target authentication items is the difference between the sum of the number of authentication items and the single-device authentication specification of the local hardware resource;

[0046] The configuration unit is used to obtain, for each target authentication entry, the user access VLAN corresponding to the target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as the user access VLAN without authentication, so that when the user's traffic message is received through the authentication interface, the user's traffic message is forwarded based on the mapping relationship between the user access VLAN corresponding to the target authentication entry and the VXLAN.

[0047] In a third aspect, an embodiment of the present application provides an authentication entry issuing device, the authentication entry issuing device comprising:

[0048] A memory for storing program instructions;

[0049] The processor is used to call the program instructions stored in the memory, and execute the steps of the method as described in any one of the first aspects above according to the obtained program instructions.

[0050] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method described in any one of the first aspects above.

[0051] In summary, the authentication table item sending method provided in the embodiment of the present application is applied to the first cross-device link aggregation M-LAG device in the network, wherein the M-LAG device is an authentication point NAS device in the network, and the method includes: receiving a first authentication table item of a first user terminal successfully authenticated sent by a second M-LAG device, wherein the second M-LAG device generates the first authentication table item based on the message of successful authentication of the first user terminal after receiving the message of successful authentication of the first user terminal sent by the authentication server; marking the first authentication table item as an inactive state, wherein when an authentication table item is marked as an inactive state, the authentication table item is not sent to the hardware resources.

[0052] By adopting the authentication entry delivery method provided in the embodiment of the present application, M-LAG networking is implemented. In the distributed parity mode, the user resources accessed by the M-LAG member devices are reduced, and the access specifications of the devices as M-LAG members are effectively improved.

[0053] For example, only terminal users authenticated on the M-LAG device, that is, those with Active entries, are sent to the hardware resources, and Inactive entries no longer occupy hardware resources. Under normal M-LAG networking, up to half of the access user hardware resources can be saved. For example, the single-machine access authentication specification of switches A and B is 2K. When forming an M-LAG system, and the switches under it are dual-owned to access the M-LAG system, then the overall access users of the M-LAG system are 2K, but there are actually only 1K access users on A and B (Active, and the other 1K are Inactive, both of which are Active users on the opposite neighbor). After using the technical solution provided in the embodiment of the present application, it can be expanded to 4K, that is, 2K access users on A and B respectively, and the other 2K Inactive entries do not occupy access hardware resources, which is doubled. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments of the present application or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present application.

[0055] Figure 1 A detailed flow chart of a method for issuing authentication items provided in an embodiment of the present application;

[0056] Figure 2 A typical networking diagram of M-LAG networking authentication provided in an embodiment of the present application;

[0057] Figure 3A flow chart of a method for issuing authentication items provided in an embodiment of the present application;

[0058] Figure 4 A schematic diagram of the structure of an authentication table item issuing device provided in an embodiment of the present application;

[0059] Figure 5 A schematic diagram of the hardware architecture of an authentication entry issuing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, rather than limiting the present application. The singular forms of "a", "said" and "the" used in the present application and claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to any or all possible combinations of one or more associated listed items.

[0061] It should be understood that, although the terms first, second, third, etc. may be used to describe various information in the embodiments of the present application, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, in addition, the word "if" used may be interpreted as "at..." or "when..." or "in response to determination".

[0062] For example, see Figure 1 As shown, it is a detailed flow chart of a method for issuing an authentication table item provided in an embodiment of the present application, the method is applied to a first multichassis link aggregation (M-LAG) device in a network, wherein the M-LAG device is an authentication point NAS device in the network, and the method comprises the following steps:

[0063] Step 100: Receive a first authentication entry sent by a second M-LAG device indicating successful authentication of a first user terminal.

[0064] In the embodiment of the present application, after receiving the message sent by the authentication server indicating that the first user terminal has been successfully authenticated, the second M-LAG device generates the first authentication entry based on the message indicating that the first user terminal has been successfully authenticated.

[0065] Specifically, after the second M-LAG device receives the message of successful authentication of the first user terminal sent by the authentication server, it generates a first authentication table item corresponding to the first user terminal based on the message of successful authentication of the first user terminal, and synchronizes the first authentication table item to the first M-LAG device through the IPL link between the first M-LAG device and the first M-LAG device. The first M-LAG device receives the first authentication table item sent by the second M-LAG device.

[0066] For example, see Figure 2 As shown, it is a typical network diagram of M-LAG network authentication provided in an embodiment of the present application, and the network description is as follows:

[0067] 1. Adopt the campus standard VXLAN three-layer architecture network: Spine, Leaf, Access (traditional network as core, aggregation and access);

[0068] 2. Two Leaf devices form an M-LAG group, and the device models and versions must be consistent;

[0069] 3. Take the authentication server as an AAA server as an example for explanation;

[0070] 4. Taking MAC address authentication as an example, 802.1X authentication and Portal authentication are also applicable to the technical solution provided in the embodiment of the present application;

[0071] 5. According to the M-LAG distributed even-odd authentication mode, it is assumed that the odd MAC user is authenticated on the M-LAG A device, and the even MAC user is authenticated on the M-LAG B device;

[0072] The AD-Campus controller has completed the management of networking devices (Spine, Leaf, Access), and has been successfully activated. The intercommunication and auditing with the AAA server are normal. Relevant business configurations, such as security groups and authentication (AAA, MAC authentication or 802.1X authentication), have been sent to Spine, Leaf, and Access through the campus controller.

[0073] In the embodiment of the present application, the above authentication entry issuing method may further include the following steps:

[0074] Receive an access authentication request sent by a second user terminal, and send the access authentication request to an authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request; receive a message sent by the authentication server indicating that the second user terminal has been successfully authenticated; generate a second authentication table entry indicating that the second user terminal has been successfully authenticated based on the message indicating that the second user terminal has been successfully authenticated; mark the second authentication table entry as active, and send the second authentication table entry to hardware resources.

[0075] Furthermore, in the embodiment of the present application, the authentication entry issuing method may further include the following steps:

[0076] The second authentication entry is sent to the second M-LAG device, so that the second M-LAG device marks the second authentication entry as inactive.

[0077] In actual applications, after an M-LAG device receives an access authentication request from a user terminal, if it is determined that the access authentication request needs to be processed locally, the authentication request is sent to the authentication server, and the authentication server authenticates the user terminal based on the access authentication request. It should be noted that in the embodiment of the present application, the authentication process of the authentication server on the user terminal is not repeated. After determining that the user terminal has passed the authentication, the authentication server sends a message of successful authentication of the user terminal to the M-LAG device, and the M-LAG device generates an authentication table item corresponding to the user terminal based on the successful authentication message. In actual applications, the authentication table item needs to be sent to the hardware resource to take effect. For example, in the scenario where the M-LAG device is a switch, the hardware resource is an ACL resource. In the embodiment of the present application, after obtaining an authentication table item, the M-LAG device does not directly send the authentication table item to the hardware resource, but first determines whether the user terminal corresponding to the authentication table item is a locally authenticated user terminal. If so, the authentication table item is set to an active state (Active) and the authentication table item is sent to the hardware resource; if not, the authentication table item is set to an inactive state (Inactive).

[0078] Step 110: Mark the first authentication entry as inactive, wherein when an authentication entry is marked as inactive, the authentication entry is not sent to the hardware resource.

[0079] In the embodiment of the present application, the first user terminal is not a user terminal authenticated by the first M-LAG device, that is, after being authenticated and accessing the network, the first user terminal does not access the network through the first M-LAG device. At this time, after the first M-LAG device receives the first authentication table item corresponding to the first user terminal, it marks the first authentication table item as inactive and does not send the first authentication table item to the hardware resource. This avoids sending the first authentication table item to the hardware resource, thereby causing a waste of hardware resources.

[0080] In the embodiment of the present application, the above authentication entry issuing method may further include the following steps:

[0081] When a failure of the second M-LAG device is detected, determining whether the sum of the number of authentication entries in the active state and the number of authentication entries in the inactive state maintained locally is greater than a single device authentication specification of local hardware resources;

[0082] If it is determined that the sum of the number of authentication items is greater than the single-device authentication specification of the local hardware resource, a number of target authentication items that meet the preset conditions are determined from the inactive authentication items, wherein the number of target authentication items is the difference between the sum of the number of authentication items and the single-device authentication specification of the local hardware resource;

[0083] For each target authentication entry, obtain the user access VLAN corresponding to the target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as the user access VLAN without authentication, so that when the user's traffic message is received through the authentication interface, the user's traffic message is forwarded based on the mapping relationship between the user access VLAN corresponding to the target authentication entry and the VXLAN.

[0084] In actual applications, if the sum of Active and Inactive entries maintained on the first M-LAG device (e.g., M-LAG A) or the second M-LAG device (e.g., M-LAG B) is greater than the single-device authentication specification (e.g., 2K), if 1.5K users are connected to M-LAG A and 1.5K users are connected to M-LAG B, then the M-ALG system fails (taking the failure of M-LAG A as an example), 3K authentication entries will appear on M-LAG B, exceeding the single-device authentication specification (2K), and the excess user traffic will fail to be forwarded, affecting terminal Internet access.

[0085] In the embodiment of the present application, in order to reduce the impact of traffic forwarding of these over-specification users after the M-LAG system is abnormal, when the switch M-LAG system detects a member device failure, the over-specification authentication table items with short access time and on-demand (Inactive) items are directly deleted, so that they do not issue hardware resources, and at the same time, these users are set to be exempted from authentication and retain the dynamic VXLAN forwarding table items (the mapping relationship between user VLAN and VXLAN), so that the traffic forwarding of these users is not affected (in the related art, the device authentication table items are deleted, and the dynamic VXLAN forwarding table items are deleted synchronously. In the embodiment of the present application, a new means is adopted to remove the on-demand authentication table items. After receiving the message of the M-LAG system abnormality, it is first determined whether the total number of authentication table items maintained locally exceeds the authentication specifications of the local machine. If exceeded, the users of the excess part and the authentication table item status of Inactive are set to be exempted from authentication. At the same time, only the authentication table items of the users of the excess part and the authentication table item status of Inactive are deleted, and the corresponding dynamic VXLAN forwarding table items are retained. Further, if the M-LAG When device A recovers, the authentication-free VLAN information of the previous interface is deleted, and authentication is retriggered (MAC is not aware, and the 802.1x client automatically reconnects, so the user is also unaware). M-LAG A and M-LAG B refresh the authentication table entries and dynamic VXLAN forwarding table entries.

[0086] In actual applications, the system determines the conditions that exceed the authentication specifications: the switch AAA module will send an alarm message, and the method of setting the authentication-free method for users exceeding the specifications: the switch obtains the user's access VLAN information through the authentication table entry and configures the authentication interface as port-security free-vlan vlan-id.

[0087] The following describes in detail the process of the authentication table entry delivery method provided in the embodiment of the present application in combination with a specific application scenario. Figure 2As shown, Leaf A and Leaf B form an M-LAG group, which serves as the authentication point NAS device for user access, and its management port IPs are 130.1.0.3 / 24 and 130.1.0.2 / 24 respectively. The m-lag virtual IP addresses of the management ports are 130.1.0.5 / 24 and 130.1.0.6 / 24 respectively. In the embodiment of the present application, when the member device of the M-LAG serves as a backup NAS point, the authentication table item on-demand delivery function is enabled, that is, the authentication table items synchronized from the M-LAG master device to the M-LAG backup device (the table items with the M-LAG user state field being Inactive) are not delivered to the hardware, and a new command is added: nas-ip m-lag peer*.*.*.*on-demand (on-demand: specifies the hardware resources for delivering authentication table items on demand. If this parameter is not specified, the authentication table items will be delivered directly to the hardware resources).

[0088] like Figure 3 As shown, it is a process flow chart of a method for issuing authentication items provided in an embodiment of the present application;

[0089] When terminal user 1 (0010-9418-0001) accesses the network, the M-LAG A device will process the authentication request of the user (if the M-LAG B device receives the authentication request first, it will be transparently transmitted to the A device for processing). After the authentication server returns the authentication success message, the table entry of the user on the M-LAG A device is set to the Active state, and then M-LAG A and the authentication server exchange authentication, authorization and billing messages of user 1. At this time, according to relevant technologies, the device A will send down relevant hardware resources to occupy hardware resources. The specific table entries are as follows:

[0090] [M-LAG A]display mac-authentication connection user-mac 0010-9418-0001

[0091] Total connections:1

[0092] Slot ID:1

[0093] User MAC address:0010-9418-0001

[0094] M-LAG NAS-IP type:Local

[0095] M-LAG user state: Active

[0096] Access interface:Bridge-Aggregation3

[0097] Username:001094180001

[0098] User access state:Successful

[0099] Authentication domain:isp

[0100] IPv4 address:199.93.48.11

[0101] IPv4 address source:IP Source Guard

[0102] Initial VLAN:172

[0103] Authorization untagged VLAN:N / A

[0104] Authorization tagged VLAN:N / A

[0105] Authorization VSI:vsi3

[0106] Authorization microsegment ID:N / A

[0107] Authorization ACL number / name:N / A

[0108] Authorization dynamic ACL name:N / A

[0109] Authorization user profile:N / A

[0110] Authorization CAR:N / A

[0111] Authorization URL:N / A

[0112] Authorization IPv6 URL:N / A

[0113] Authorization temporary redirect:Disabled

[0114] Authorization redirect match terminal rule:N / A

[0115] Start accounting:Successful

[0116] Real-time accounting-update failures:0

[0117] Termination action:Default

[0118] Session timeout period:86400sec

[0119] Offline detection:Ignore(server-assigned)

[0120] Online from:2024 / 08 / 29 14:42:59

[0121] Online duration:1h 39m 43s

[0122] Port-down keep online:Disabled(offline)

[0123] M-LAG A synchronizes the authentication information of terminal user 1 (0010-9418-0001) to M-LAG B through the IPL link of the M-LAG system. The status on M-LAG B is Inactive. According to the on-demand parameters configured in the previous steps, M-LAG B will no longer send the authentication table entries of this user to the hardware. The specific entries are as follows:

[0124] [M-LAG B]display mac-authentication connection user-mac 0010-9418-0001

[0125] Total connections:1

[0126] Slot ID:1

[0127] User MAC address:0010-9418-0001

[0128] M-LAG NAS-IP type:Peer

[0129] M-LAG user state:Inactive(on-demand)

[0130] Access interface:Bridge-Aggregation3

[0131] Username:001094180001

[0132] User access state:Successful

[0133] Authentication domain:isp

[0134] IPv4 address:199.93.48.11

[0135] IPv4 address source:IP Source Guard

[0136] Initial VLAN:172

[0137] Authorization untagged VLAN:N / A

[0138] Authorization tagged VLAN:N / A

[0139] Authorization VSI:vsi3

[0140] Authorization microsegment ID:N / A

[0141] Authorization ACL number / name:N / A

[0142] Authorization dynamic ACL name:N / A

[0143] Authorization user profile:N / A

[0144] Authorization CAR:N / A

[0145] Authorization URL:N / A

[0146] Authorization IPv6 URL:N / A

[0147] Authorization temporary redirect:Disabled

[0148] Authorization redirect match terminal rule:N / A

[0149] Start accounting:Successful

[0150] Real-time accounting-update failures:0

[0151] Termination action:Default

[0152] Session timeout period:86400 sec

[0153] Offline detection:Ignore(server-assigned)

[0154] Online from:2024 / 08 / 29 14:42:59

[0155] Online duration:1h 40m 46s

[0156] Port-down keep online:Disabled(offline)

[0157] Still Figure 3 As shown, terminal user 2 (0010-9418-0002) accesses the network, and the M-LAG B device processes the user's authentication request (if the M-LAG A device receives the authentication request first, it will be transparently transmitted to the B device for processing). After the authentication server returns the authentication success message, the user's table entry on the M-LAG B device is set to the Active state, and subsequently M-LAG B exchanges authentication, authorization, and accounting messages of user 1 with the authentication server. At this time, according to relevant technologies, device B will send down relevant hardware resources, occupying hardware resources.

[0158] If the M-LAG A device fails (including device failure, M-LAG A unavailability caused by uplink and downlink links, etc.), the authentication entry of terminal user 1 (0010-9418-0001) on the M-LAG B device will be updated to Active, and the hardware entry will be issued immediately. Subsequently, M-LAG B will exchange authentication, authorization, and accounting messages of user 1 with the authentication server.

[0159] If the M-LAG A device recovers from the fault and re-forms the M-LAG system with the M-LAG B device, the authentication entry of the terminal user 1 (0010-9418-0001) on the M-LAG B device will be updated to Inactive, and the timer M-LAG_JR-Timer will be started. For example, the default value is 12 minutes, and the configurable range is 1-30 minutes (in minutes). When the time reaches the M-LAG_JR-Timer, the hardware entry will be deleted to release the hardware resources; at this time, the authentication entry of the terminal user 1 (0010-9418-0001) on the M-LAG A device will be updated to Active, and the hardware entry will be issued immediately. After the terminal user 2 (0010-9418-0002) recovers on M-LAG A, it is still in the Inactive state before the fault, that is, no hardware entry is issued. As shown in the following table, there is no on-demand parameter after Inactive, which means that the authentication user still occupies hardware resources. After the aging time is released, it becomes Inactive (on-demand).

[0160] Entries within the M-LAG_JR-Timer aging time:

[0161] [M-LAG B]display mac-authentication connection user-mac 0010-9418-0001

[0162] Total connections:1

[0163] Slot ID:1

[0164] User MAC address:0010-9418-0001

[0165] M-LAG NAS-IP type:Peer

[0166] M-LAG user state: Inactive

[0167] Access interface:Bridge-Aggregation3

[0168] Username:001094180001

[0169] User access state:Successful

[0170] Authentication domain:isp

[0171] IPv4 address:199.93.48.11

[0172] IPv4 address source:IP Source Guard

[0173] Initial VLAN:172

[0174] Authorization untagged VLAN:N / A

[0175] Authorization tagged VLAN:N / A

[0176] Authorization VSI:vsi3

[0177] Authorization microsegment ID:N / A

[0178] Authorization ACL number / name:N / A

[0179] Authorization dynamic ACL name:N / A

[0180] Authorization user profile:N / A

[0181] Authorization CAR:N / A

[0182] Authorization URL:N / A

[0183] Authorization IPv6 URL:N / A

[0184] Authorization temporary redirect:Disabled

[0185] Authorization redirect match terminal rule:N / A

[0186] Start accounting:Successful

[0187] Real-time accounting-update failures:0

[0188] Termination action:Default

[0189] Session timeout period: 86400 sec

[0190] Offline detection: Ignore (server - assigned)

[0191] Online from: 2024 / 08 / 29 15:42:59

[0192] Online duration: 2h 40m 46s

[0193] Port - down keep online: Disabled (offline)

[0194] Entries after the aging time of M - LAG_JR - Timer:

[0195] [M - LAG B]display mac - authentication connection user - mac 0010 - 9418 - 0001

[0196] Total connections: 1

[0197] Slot ID: 1

[0198] User MAC address: 0010 - 9418 - 0001

[0199] M - LAG NAS - IP type: Peer

[0200] M - LAG user state: Inactive (on - demand)

[0201] Access interface: Bridge - Aggregation3

[0202] Username: 001094180001

[0203] User access state: Successful

[0204] Authentication domain: isp

[0205] IPv4 address: 199.93.48.11

[0206] IPv4 address source: IP Source Guard

[0207] Initial VLAN:172

[0208] Authorization untagged VLAN:N / A

[0209] Authorization tagged VLAN:N / A

[0210] Authorization VSI:vsi3

[0211] Authorization microsegment ID:N / A

[0212] Authorization ACL number / name:N / A

[0213] Authorization dynamic ACL name:N / A

[0214] Authorization user profile:N / A

[0215] Authorization CAR:N / A

[0216] Authorization URL:N / A

[0217] Authorization IPv6 URL:N / A

[0218] Authorization temporary redirect:Disabled

[0219] Authorization redirect match terminal rule:N / A

[0220] Start accounting:Successful

[0221] Real-time accounting-update failures:0

[0222] Termination action:Default

[0223] Session timeout period:86400sec

[0224] Offline detection:Ignore(server-assigned)

[0225] Online from:2024 / 08 / 29 15:5759

[0226] Online duration:2h 55m 46s

[0227] Port-down keep online:Disabled(offline)

[0228] After M-LAG A fails and recovers, terminal user 2 (0010-9418-0002) is not involved in the switching of authentication status, so the delivery of hardware resources is not involved in this process.

[0229] It is necessary to configure the M-LAG MAD function and reserve ports to prevent the M-LAG system from splitting, which will not be described in detail in the embodiments of the present application.

[0230] When a single access switch is connected to the M-LAG system, access authentication is performed only on one M-LAG member device, and access authentication hardware resources are only occupied on this member device. The peer end does not consume access authentication resources.

[0231] For example, see Figure 4 As shown, it is a structural schematic diagram of an authentication table entry issuing device provided in an embodiment of the present application, the device is applied to a first inter-device link aggregation M-LAG device in a network, wherein the M-LAG device is an authentication point NAS device in the network, and the device includes:

[0232] The receiving unit 40 is configured to receive a first authentication entry of a first user terminal successfully authenticated and sent by a second M-LAG device, wherein the second M-LAG device generates the first authentication entry based on the message of successful authentication of the first user terminal after receiving the message of successful authentication of the first user terminal sent by the authentication server;

[0233] The marking unit 41 is configured to mark the first authentication entry as being in an inactive state, wherein when an authentication entry is marked as being in an inactive state, the authentication entry is not sent to the hardware resource.

[0234] Optionally, the device further includes a sending unit, a generating unit and a sending unit:

[0235] The receiving unit 40 is further configured to receive an access authentication request sent by a second user terminal;

[0236] The sending unit is used to send the access authentication request to the authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request;

[0237] The receiving unit 40 is further configured to receive a message from the authentication server indicating that the second user terminal has been successfully authenticated;

[0238] The generating unit is used to generate a second authentication entry of successful authentication of the second user terminal based on the message of successful authentication of the second user terminal;

[0239] The marking unit 41 is further used to mark the second authentication entry as active;

[0240] The sending unit is used to send the second authentication table entry to the hardware resource.

[0241] Optionally, the sending unit is further configured to send the second authentication entry to the second M-LAG device, so that the second M-LAG device marks the second authentication entry as inactive.

[0242] Optionally, the receiving unit 40 is further configured to receive an authentication request sent by a third user terminal;

[0243] If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed locally, the sending unit is further used to send the authentication request sent by the third user terminal to the authentication server for access authentication processing;

[0244] If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed by the second M-LAG device, the sending unit is also used to transparently transmit the authentication request sent by the third user terminal to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to the authentication server for access authentication processing.

[0245] Optionally, the device further comprises:

[0246] A judgment unit, when a failure of the second M-LAG device is detected, the judgment unit is used to judge whether the sum of the number of authentication items in the active state and the number of authentication items in the inactive state maintained locally is greater than the single device authentication specification of the local hardware resources;

[0247] A determination unit, wherein if the determination unit determines that the sum of the number of authentication items is greater than the single-device authentication specification of the local hardware resource, the determination unit is used to determine a number of target authentication items that meet a preset condition from the inactive authentication items, wherein the number of the target authentication items is the difference between the sum of the number of authentication items and the single-device authentication specification of the local hardware resource;

[0248] The configuration unit is used to obtain, for each target authentication entry, the user access VLAN corresponding to the target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as the user access VLAN without authentication, so that when the user's traffic message is received through the authentication interface, the user's traffic message is forwarded based on the mapping relationship between the user access VLAN corresponding to the target authentication entry and the VXLAN.

[0249] The above units may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs). For another example, when a certain unit is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processors that can call program code. For another example, these units may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0250] Further, the authentication table item issuing device provided in the embodiment of the present application, from the hardware level, the hardware architecture diagram of the authentication table item issuing device can be seen in Figure 5 As shown, the authentication entry issuing device may include: a memory 50 and a processor 51,

[0251] The memory 50 is used to store program instructions; the processor 51 calls the program instructions stored in the memory 50 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar and will not be repeated here.

[0252] Optionally, the present application also provides an M-LAG device, comprising at least one processing element (or chip) for executing the above method embodiment.

[0253] Optionally, the present application also provides a program product, such as a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the above method embodiments.

[0254] Here, the machine-readable storage medium may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (RadomAccess Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.

[0255] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0256] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0257] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0258] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0259] Moreover, these computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0260] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0261] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for issuing authentication entries, characterized in that: A first inter-device link aggregation M-LAG device is applied to a network, wherein the M-LAG device is an authentication point NAS device in the network, and the method includes: Receiving a first authentication entry of a first user terminal successful authentication sent by a second M-LAG device, wherein the second M-LAG device generates the first authentication entry based on the message of the first user terminal successful authentication after receiving a message of the first user terminal successful authentication sent by an authentication server; The first authentication entry is marked as an inactive state, wherein when an authentication entry is marked as an inactive state, the authentication entry is not sent to the hardware resource.

2. The method according to claim 1, characterized in that The method further comprises: receiving an access authentication request sent by a second user terminal, and sending the access authentication request to an authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request; Receiving a message from the authentication server indicating that the second user terminal has been successfully authenticated; Generate a second authentication entry of successful authentication of the second user terminal based on the message of successful authentication of the second user terminal; The second authentication entry is marked as active, and the second authentication entry is sent to the hardware resource.

3. The method according to claim 2, characterized in that The method further comprises: The second authentication entry is sent to the second M-LAG device, so that the second M-LAG device marks the second authentication entry as inactive.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Receiving an authentication request sent by a third user terminal; If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed locally, the authentication request sent by the third user terminal is sent to the authentication server for access authentication processing; If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed by the second M-LAG device, the authentication request sent by the third user terminal is transparently transmitted to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to the authentication server for access authentication processing.

5. The method according to claim 1, characterized in that The method further comprises: When a failure of the second M-LAG device is detected, determining whether the sum of the number of authentication entries in the active state and the number of authentication entries in the inactive state maintained locally is greater than a single device authentication specification of local hardware resources; If it is determined that the sum of the number of authentication items is greater than the single-device authentication specification of the local hardware resource, a number of target authentication items that meet the preset conditions are determined from the inactive authentication items, wherein the number of target authentication items is the difference between the sum of the number of authentication items and the single-device authentication specification of the local hardware resource; For each target authentication entry, obtain the user access VLAN corresponding to the target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as the user access VLAN without authentication, so that when the user's traffic message is received through the authentication interface, the user's traffic message is forwarded based on the mapping relationship between the user access VLAN corresponding to the target authentication entry and the VXLAN.

6. A device for issuing authentication entries, characterized in that: A first inter-device link aggregation M-LAG device applied to a network, wherein the M-LAG device is an authentication point NAS device in the network, and the apparatus includes: A receiving unit, configured to receive a first authentication entry of a first user terminal successfully authenticated, sent by a second M-LAG device, wherein the second M-LAG device generates the first authentication entry based on the message of successful authentication of the first user terminal after receiving a message of successful authentication of the first user terminal sent by an authentication server; The marking unit is used to mark the first authentication entry as an inactive state, wherein when an authentication entry is marked as an inactive state, the authentication entry is not sent to the hardware resource.

7. The device according to claim 6, characterized in that The device also includes a sending unit, a generating unit and a sending unit: The receiving unit is further configured to receive an access authentication request sent by a second user terminal; The sending unit is used to send the access authentication request to the authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request; The receiving unit is further configured to receive a message sent by the authentication server indicating that the second user terminal has been successfully authenticated; The generating unit is used to generate a second authentication entry of successful authentication of the second user terminal based on the message of successful authentication of the second user terminal; The marking unit is further used to mark the second authentication entry as active; The sending unit is used to send the second authentication table entry to the hardware resource.

8. The device according to claim 7, characterized in that The sending unit is further configured to send the second authentication entry to the second M-LAG device, so that the second M-LAG device marks the second authentication entry as inactive.

9. The device according to any one of claims 6 to 8, characterized in that: The receiving unit is further configured to receive an authentication request sent by a third user terminal; If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed locally, the sending unit is further used to send the authentication request sent by the third user terminal to the authentication server for access authentication processing; If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed by the second M-LAG device, the sending unit is also used to transparently transmit the authentication request sent by the third user terminal to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to the authentication server for access authentication processing.

10. The device according to claim 6, characterized in that The device also includes: A judgment unit, when a failure of the second M-LAG device is detected, the judgment unit is used to judge whether the sum of the number of authentication items in the active state and the number of authentication items in the inactive state maintained locally is greater than the single device authentication specification of the local hardware resources; A determination unit, wherein if the determination unit determines that the sum of the number of authentication items is greater than the single-device authentication specification of the local hardware resource, the determination unit is used to determine a number of target authentication items that meet a preset condition from the inactive authentication items, wherein the number of the target authentication items is the difference between the sum of the number of authentication items and the single-device authentication specification of the local hardware resource; The configuration unit is used to obtain, for each target authentication entry, the user access VLAN corresponding to the target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as the user access VLAN without authentication, so that when the user's traffic message is received through the authentication interface, the user's traffic message is forwarded based on the mapping relationship between the user access VLAN corresponding to the target authentication entry and the VXLAN.

11. A device for issuing authentication entries, characterized in that: The authentication entry issuing device comprises: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps of the method according to any one of claims 1 to 5 according to the obtained program instructions.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method according to any one of claims 1 to 5.

Images