A method, apparatus and related equipment for issuing authentication forms.

Abstract

This application relates to the field of network communication technology, and in particular to a method, apparatus, and related equipment for issuing authentication entries. The method is applied to a first cross-device link aggregation (M-LAG) device in a network, wherein the M-LAG device is an authentication point (NAS) device in the network. The method includes: receiving a first authentication entry from a second M-LAG device indicating successful authentication of a first user terminal; wherein the second M-LAG device generates the first authentication entry based on the successful authentication message from the authentication server; and marking the first authentication entry as inactive, wherein when an authentication entry is marked as inactive, the authentication entry is not issued to hardware resources.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to a method, apparatus and related equipment for issuing authentication entries. Background Technology

[0002] M-LAG (Multichassis link aggregation) virtualizes two physical devices into a single device at the aggregation level to achieve cross-device link aggregation, thereby providing device-level redundancy protection and traffic load balancing. For example, Device A and Device B form a load-sharing mechanism and jointly forward traffic. When one device fails, traffic can be quickly switched to the other device to ensure the normal operation of services.

[0003] Currently, M-LAG uses two authentication methods for user terminals: centralized processing mode and distributed processing mode.

[0004] In the centralized processing mode:

[0005] If the primary device receives a user message, it processes it directly on the primary device. If the secondary device receives a user message, it first performs necessary message parsing, then notifies the primary device for further processing, and the primary device actively interacts with the AAA server and client to exchange authentication-related messages. In this mode, configuration is relatively simple; the RADIUS server only needs to manage one access device IP, and both M-LAG devices only need to be configured with the same RADIUS message source IP address. However, user message distribution efficiency is low, making it suitable for scenarios with a small number of access users. Furthermore, processing can only be performed on the primary M-LAG device, resulting in a high risk of single point of failure and failing to achieve true high availability.

[0006] In distributed processing mode:

[0007] Local mode: User packets sent from the local M-LAG interface are processed by the local M-LAG device.

[0008] Parity / Even Mode: When a host receives a user packet, it parses the user's source MAC address in the packet. Based on the port security configuration, odd MAC addresses are processed on one M-LAG device, and even MAC addresses are processed on another M-LAG device. If processing is required at the other end, the packet is forwarded to that end for processing.

[0009] In distributed processing mode, user packet distribution efficiency is high, but the RADIUS server needs to manage two access device IPs. Both M-LAG devices need to be configured with the source IP addresses of the RADIUS packets used by the local device and the peer device simultaneously, making it suitable for scenarios with a large number of users coming online at once. Among these, the local mode has the highest distribution efficiency, followed by the parity mode. In campus M-LAG access authentication networks, the distributed processing parity mode is generally used. However, in the distributed processing parity mode, both the master and slave devices will have half of their entries inactive. Under normal M-LAG system conditions, this wastes half of the device access resources. Summary of the Invention

[0010] This application provides a method, apparatus, and related equipment for issuing authentication entries, in order to solve the problem of wasted hardware resources in related technologies.

[0011] In a first aspect, this application provides a method for issuing authentication entries, applied to a first cross-device link aggregation (M-LAG) device in a network, wherein the M-LAG device is an authentication point (NAS) device in the network, and the method includes:

[0012] The second M-LAG device receives a first authentication entry sent by the second M-LAG device indicating that the first user terminal has been successfully authenticated. The second M-LAG device generates the first authentication entry based on the message indicating that the first user terminal has been successfully authenticated after receiving the message from the authentication server.

[0013] The first authentication entry is marked as inactive, wherein when an authentication entry is marked as inactive, the authentication entry is not sent to hardware resources.

[0014] Optionally, the method further includes:

[0015] The system receives an access authentication request sent by a second user terminal and sends the access authentication request to an authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request.

[0016] Receive the message from the authentication server indicating that the second user terminal has been successfully authenticated;

[0017] Generate a second authentication entry based on the message indicating successful authentication of the second user terminal.

[0018] The second authentication entry is marked as active, and the second authentication entry is sent to the hardware resources.

[0019] Optionally, the method further includes:

[0020] The second authentication entry is sent to the second M-LAG device so that the second M-LAG device marks the second authentication entry as inactive.

[0021] Optionally, the method further includes:

[0022] Receive authentication requests sent by third-party user terminals;

[0023] If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed locally, then the authentication request sent by the third user terminal is sent to the authentication server for access authentication processing.

[0024] If it is determined that the authentication request sent by the third user terminal is an authentication request that the second M-LAG device needs to process, then the authentication request sent by the third user terminal is transparently transmitted to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to the authentication server for access authentication processing.

[0025] Optionally, the method further includes:

[0026] When a second M-LAG device failure is detected, determine whether the sum of the number of locally maintained active and inactive authentication entries is greater than the single-device authentication specification of the local hardware resources.

[0027] If the sum of the number of authentication entries is greater than the single-device authentication specification of the local hardware resources, then a number of target authentication entries that meet the preset conditions are determined from the inactive authentication entries. The number of target authentication entries is the difference between the sum of the number of authentication entries and the single-device authentication specification of the local hardware resources.

[0028] For each target authentication entry, obtain the user access VLAN corresponding to the target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as an authentication-free interface for the user access VLAN. This enables the user's traffic packets to be forwarded based on the mapping relationship between the user access VLAN and VXLAN corresponding to the target authentication entry when the user's traffic packets are received through the authentication interface.

[0029] Secondly, this application provides an authentication entry distribution device, applied to a first cross-device link aggregation (M-LAG) device in a network, wherein the M-LAG device is an authentication point (NAS) device in the network, and the device includes:

[0030] The receiving unit is configured to receive a first authentication entry sent by the second M-LAG device indicating that the first user terminal has been successfully authenticated, wherein the second M-LAG device generates the first authentication entry based on the message indicating that the first user terminal has been successfully authenticated after receiving the message from the authentication server.

[0031] The marking unit is used to mark the first authentication entry as inactive, wherein when an authentication entry is marked as inactive, the authentication entry is not sent to hardware resources.

[0032] Optionally, the apparatus further includes a sending unit, a generating unit, and a sending unit:

[0033] The receiving unit is further configured to receive an access authentication request sent by the second user terminal;

[0034] The sending unit is used to send the access authentication request to the authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request;

[0035] The receiving unit is further configured to receive a message from the authentication server indicating that the second user terminal has been successfully authenticated;

[0036] The generation unit is used to generate a second authentication entry for successful authentication of the second user terminal based on the message indicating that the second user terminal has been successfully authenticated.

[0037] The marking unit is further configured to mark the second authentication entry as active.

[0038] The issuing unit is used to issue the second authentication entry to the hardware resources.

[0039] Optionally, the sending unit is further configured to send the second authentication entry to the second M-LAG device, so that the second M-LAG device marks the second authentication entry as inactive.

[0040] Optionally, the receiving unit is further configured to receive an authentication request sent by a third user terminal;

[0041] If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed locally, the sending unit is further configured to send the authentication request sent by the third user terminal to the authentication server for access authentication processing.

[0042] If it is determined that the authentication request sent by the third user terminal is an authentication request that the second M-LAG device needs to process, the sending unit is further configured to pass through the authentication request sent by the third user terminal to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to the authentication server for access authentication processing.

[0043] Optionally, the device further includes:

[0044] When a second M-LAG device malfunction is detected, the judgment unit is used to determine whether the sum of the number of locally maintained active authentication entries and inactive authentication entries is greater than the single device authentication specification of the local hardware resources.

[0045] If the determination unit determines that the sum of the number of authentication entries is greater than the single-device authentication specification of the local hardware resources, then the determination unit is used to determine a number of target authentication entries that meet preset conditions from the authentication entries in the inactive state, wherein the number of target authentication entries is the difference between the sum of the number of authentication entries and the single-device authentication specification of the local hardware resources.

[0046] The configuration unit is used to obtain the user access VLAN corresponding to each target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as an authentication-free interface for the user access VLAN, so that when the user's traffic packet is received through the authentication interface, the user's traffic packet is forwarded based on the mapping relationship between the user access VLAN and VXLAN corresponding to the target authentication entry.

[0047] Thirdly, embodiments of this application provide an authentication entry issuing device, which includes:

[0048] Memory, used to store program instructions;

[0049] A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the first aspects above, according to the obtained program instructions.

[0050] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the steps of the method as described in any of the first aspects above.

[0051] In summary, the authentication entry distribution method provided in this application is applied to a first cross-device link aggregation (M-LAG) device in a network, wherein the M-LAG device is an authentication point (NAS) device in the network. The method includes: receiving a first authentication entry sent by a second M-LAG device indicating successful authentication of a first user terminal, wherein the second M-LAG device generates the first authentication entry based on the successful authentication message of the first user terminal after receiving it from the authentication server; and marking the first authentication entry as inactive, wherein when an authentication entry is marked as inactive, the authentication entry is not distributed to hardware resources.

[0052] The authentication entry distribution method provided in this application embodiment realizes M-LAG networking. In the distributed parity mode, it reduces the access resources of M-LAG member devices to users and effectively improves the access specifications of devices when they are M-LAG members.

[0053] For example, only end users authenticated on the M-LAG device, i.e., those with active entries, are allocated hardware resources; inactive entries no longer occupy hardware resources. In a normal M-LAG network, this can save up to half the hardware resources required for access users. For instance, if switches A and B have a single-machine access authentication specification of 2K, and are configured in an M-LAG system with dual-homed switches, then the total number of access users in the M-LAG system is 2K. However, A and B actually only have 1K access users (Active, and the other 1K are Inactive, both Active users on their peer's neighbor). Using the technical solution provided in this application, this can be expanded to 4K, meaning 2K access users each on A and B, with the additional 2K Inactive entries not occupying access hardware resources, effectively doubling the capacity. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.

[0055] Figure 1 A detailed flowchart illustrating an authentication entry distribution method provided in this application embodiment;

[0056] Figure 2 Typical network diagram for M-LAG network authentication provided in this application embodiment;

[0057] Figure 3A flowchart illustrating an authentication entry distribution method provided in this application embodiment;

[0058] Figure 4 A schematic diagram of the structure of an authentication form issuing device provided in an embodiment of this application;

[0059] Figure 5 This is a schematic diagram of the hardware architecture of an authentication entry issuing device provided in an embodiment of this application. Detailed Implementation

[0060] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.

[0061] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."

[0062] For example, see Figure 1 The diagram shown is a detailed flowchart of an authentication entry distribution method provided in this application embodiment. This method is applied to a first multichassis link aggregation (M-LAG) device in a network, wherein the M-LAG device is an authentication point (NAS) device in the network. The method includes the following steps:

[0063] Step 100: Receive the first authentication entry sent by the second M-LAG device indicating successful authentication of the first user terminal.

[0064] In this embodiment of the application, after receiving the message from the authentication server indicating that the first user terminal has been successfully authenticated, the second M-LAG device generates the first authentication entry based on the message indicating that the first user terminal has been successfully authenticated.

[0065] Specifically, after receiving the message from the authentication server that the first user terminal has been successfully authenticated, the second M-LAG device generates a first authentication entry corresponding to the first user terminal based on the message and synchronizes the first authentication entry to the first M-LAG device through the IPL link between the second and first M-LAG devices. The first M-LAG device then receives the first authentication entry sent by the second M-LAG device.

[0066] For example, see Figure 2 The diagram shown is a typical network topology diagram for M-LAG network authentication provided in this application embodiment. The network topology is described below:

[0067] 1. Adopt the standard VXLAN three-layer architecture for the campus network: Spine, Leaf, Access (traditional network as the core, aggregation and access);

[0068] 2. Two Leaf devices form an M-LAG group, and the device models and versions must be the same;

[0069] 3. The explanation will be based on the example of an AAA server as the authentication server;

[0070] 4. Taking MAC address authentication as an example, the technical solutions provided in the embodiments of this application also apply to 802.1X authentication and Portal authentication;

[0071] 5. According to the M-LAG distributed parity authentication mode, it is assumed that odd MAC users authenticate on M-LAG A device and even MAC users authenticate on M-LAG B device;

[0072] The AD-Campus controller has successfully managed and activated the network devices (Spine, Leaf, Access), and communication and auditing with the AAA server are normal. Relevant service configurations, such as security groups and authentication (AAA, MAC authentication, or 802.1X authentication), have been distributed to Spine, Leaf, and Access via the campus controller.

[0073] In this embodiment of the application, the above-mentioned authentication entry issuance method may further include the following steps:

[0074] The system receives an access authentication request sent by a second user terminal and sends the access authentication request to an authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request; receives a message from the authentication server indicating that the second user terminal has been successfully authenticated; generates a second authentication entry based on the message indicating that the second user terminal has been successfully authenticated; marks the second authentication entry as active and distributes the second authentication entry to hardware resources.

[0075] Furthermore, in this embodiment of the application, the above-mentioned authentication entry issuance method may further include the following steps:

[0076] The second authentication entry is sent to the second M-LAG device so that the second M-LAG device marks the second authentication entry as inactive.

[0077] In practical applications, after an M-LAG device receives an access authentication request from a user terminal, if it determines that the access authentication request needs to be processed locally, it sends the authentication request to the authentication server. The authentication server authenticates the user terminal based on the access authentication request. It should be noted that the authentication process of the authentication server for the user terminal is not described in detail in this embodiment. After the authentication server determines that the user terminal has passed authentication, it sends a message to the M-LAG device that the user terminal has been successfully authenticated. Based on this message, the M-LAG device generates an authentication entry corresponding to the user terminal. In practical applications, authentication entries need to be sent to hardware resources to take effect. For example, in a scenario where the M-LAG device is a switch, the hardware resource is an ACL resource. In this embodiment, after obtaining an authentication entry, the M-LAG device does not directly send the authentication entry to the hardware resource. Instead, it first determines whether the user terminal corresponding to the authentication entry is a locally authenticated user terminal. If so, it sets the authentication entry to an active state and sends it to the hardware resource; otherwise, it sets the authentication entry to an inactive state.

[0078] Step 110: Mark the first authentication entry as inactive, wherein when an authentication entry is marked as inactive, the authentication entry is not sent to hardware resources.

[0079] In this embodiment, the first user terminal is not a user terminal authenticated by the first M-LAG device; that is, after successful authentication and network access, it does not access the network through the first M-LAG device. In this case, after receiving the first authentication entry corresponding to the first user terminal, the first M-LAG device marks the first authentication entry as inactive and does not distribute it to hardware resources. This avoids wasting hardware resources by distributing the first authentication entry to hardware resources.

[0080] In this embodiment of the application, the above-mentioned authentication entry issuance method may further include the following steps:

[0081] When a second M-LAG device failure is detected, determine whether the sum of the number of locally maintained active and inactive authentication entries is greater than the single-device authentication specification of the local hardware resources.

[0082] If the sum of the number of authentication entries is greater than the single-device authentication specification of the local hardware resources, then a number of target authentication entries that meet the preset conditions are determined from the inactive authentication entries. The number of target authentication entries is the difference between the sum of the number of authentication entries and the single-device authentication specification of the local hardware resources.

[0083] For each target authentication entry, obtain the user access VLAN corresponding to the target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as an authentication-free interface for the user access VLAN. This enables the user's traffic packets to be forwarded based on the mapping relationship between the user access VLAN and VXLAN corresponding to the target authentication entry when the user's traffic packets are received through the authentication interface.

[0084] In practical applications, if the sum of Active and Inactive entries maintained on the first M-LAG device (e.g., M-LAG A) or the second M-LAG device (e.g., M-LAG B) exceeds the single-device authentication specification (e.g., 2K), such as 1.5K users accessing the network on M-LAG A and 1.5K users accessing the network on M-LAG B, and the M-LAG system malfunctions (taking a malfunction of M-LAG A as an example), 3K authentication entries will appear on M-LAG B, exceeding the single-device authentication specification (2K). This will result in the inability to forward traffic for the excess user traffic, affecting the terminal's internet access.

[0085] In this embodiment, to reduce the impact of M-LAG system anomalies on traffic forwarding for these oversized users, when the M-LAG switch system detects a member device failure, it directly deletes oversized authentication entries with short access durations and on-demand (Inactive) entries, preventing them from receiving hardware resources. Simultaneously, it sets these users to be exempt from authentication while retaining the dynamic VXLAN forwarding table entries (the mapping relationship between user VLANs and VXLANs), ensuring that traffic forwarding for these users is unaffected. (In related technologies, when device authentication entries are deleted, dynamic VXLAN forwarding table entries are also deleted simultaneously. In this embodiment, a new method is used: upon receiving an M-LAG system anomaly message, the system first checks whether the total number of locally maintained authentication entries exceeds the local authentication specification. If it does, it sets the excess users with inactive authentication entries to be exempt from authentication, and only deletes the excess user authentication entries with inactive authentication entries, while retaining the corresponding dynamic VXLAN forwarding table entries.) Further, as with M-LAG... If device A recovers, the previously unauthenticated VLAN information of the interface will be deleted, and authentication will be retried (MAC will be unaware, 802.1x clients will automatically reconnect, so users will also be unaware). M-LAG A and M-LAG B will refresh the authentication table entries and the forwarding table entries of dynamic VXLAN.

[0086] In practical applications, when the system determines that the authentication specifications are exceeded, the switch's AAA module will send an alarm message. The method for setting up authentication exemption for users who exceed the specifications is as follows: the switch obtains the user's access VLAN information through the authentication table entry and configures the authentication interface as port-security free-vlan vlan-id.

[0087] The following describes in detail the process of the authentication entry issuance method provided in this application embodiment, using specific application scenarios as examples. For instance... Figure 2As shown, Leaf A and Leaf B form the M-LAG group, serving as authentication point NAS devices for user access. Their management port IPs are 130.1.0.3 / 24 and 130.1.0.2 / 24, respectively. The m-lag virtual IP addresses of the management ports are 130.1.0.5 / 24 and 130.1.0.6 / 24, respectively. In this embodiment, when the member devices of M-LAG serve as backup NAS points, the on-demand authentication entry distribution function is enabled. That is, authentication entries synchronized from the M-LAG master device to the M-LAG backup device (entries with the M-LAG user state field set to Inactive) are not distributed to the hardware. A new command is added: nas-ip m-lag peer*.*.*.*on-demand (on-demand: specifies the hardware resources for on-demand authentication entry distribution; if this parameter is not specified, the authentication entries will be directly distributed to the hardware resources).

[0088] like Figure 3 The diagram shown is a flowchart of an authentication entry issuance method provided in an embodiment of this application.

[0089] When terminal user 1 (0010-9418-0001) accesses the network, M-LAG A will process the user's authentication request (if M-LAG B receives the authentication request first, it will be forwarded to device A for processing). After the authentication server returns a successful authentication message, the user's entry on M-LAG A is set to Active state. Subsequently, M-LAG A will exchange authentication, authorization, and accounting messages for user 1 with the authentication server. At this time, according to relevant technologies, device A will allocate relevant hardware resources, which will be used. The specific entries are as follows:

[0090] [M-LAG A]display mac-authentication connection user-mac 0010-9418-0001

[0091] Total connections: 1

[0092] Slot ID:1

[0093] User MAC address:0010-9418-0001

[0094] M-LAG NAS-IP type:Local

[0095] M-LAG user state:Active

[0096] Access interface:Bridge-Aggregation3

[0097] Username:001094180001

[0098] User access state:Successful

[0099] Authentication domain:isp

[0100] IPv4 address:199.93.48.11

[0101] IPv4 address source:IP Source Guard

[0102] Initial VLAN:172

[0103] Authorization untagged VLAN:N / A

[0104] Authorization tagged VLAN:N / A

[0105] Authorization VSI:vsi3

[0106] Authorization microsegment ID:N / A

[0107] Authorization ACL number / name:N / A

[0108] Authorization dynamic ACL name:N / A

[0109] Authorization user profile:N / A

[0110] Authorization CAR:N / A

[0111] Authorization URL:N / A

[0112] Authorization IPv6 URL:N / A

[0113] Authorization temporary redirect:Disabled

[0114] Authorization redirect match terminal rule:N / A

[0115] Start accounting: Successful

[0116] Real-time accounting-update failures:0

[0117] Termination action: Default

[0118] Session timeout period:86400sec

[0119] Offline detection:Ignore(server-assigned)

[0120] Online from:2024 / 08 / 29 14:42:59

[0121] Online duration: 1 hour 39 minutes 43 seconds

[0122] Port-down keep online:Disabled(offline)

[0123] M-LAG A synchronizes the authentication information of terminal user 1 (0010-9418-0001) to the M-LAG B device via the IPL link of the M-LAG system. On the M-LAG B device, the status is Inactive. Based on the on-demand parameters configured in the previous steps, the M-LAG B device will no longer send the user's authentication entry to the hardware. The specific entries are as follows:

[0124] [M-LAG B]display mac-authentication connection user-mac 0010-9418-0001

[0125] Total connections: 1

[0126] Slot ID:1

[0127] User MAC address:0010-9418-0001

[0128] M-LAG NAS-IP type:Peer

[0129] M-LAG user state:Inactive(on-demand)

[0130] Access interface:Bridge-Aggregation3

[0131] Username:001094180001

[0132] User access state:Successful

[0133] Authentication domain:isp

[0134] IPv4 address:199.93.48.11

[0135] IPv4 address source:IP Source Guard

[0136] Initial VLAN:172

[0137] Authorization untagged VLAN:N / A

[0138] Authorization tagged VLAN:N / A

[0139] Authorization VSI:vsi3

[0140] Authorization microsegment ID:N / A

[0141] Authorization ACL number / name:N / A

[0142] Authorization dynamic ACL name:N / A

[0143] Authorization user profile:N / A

[0144] Authorization CAR:N / A

[0145] Authorization URL:N / A

[0146] Authorization IPv6 URL:N / A

[0147] Authorization temporary redirect:Disabled

[0148] Authorization redirect match terminal rule:N / A

[0149] Start accounting: Successful

[0150] Real-time accounting-update failures:0

[0151] Termination action: Default

[0152] Session timeout period:86400 sec

[0153] Offline detection:Ignore(server-assigned)

[0154] Online from:2024 / 08 / 29 14:42:59

[0155] Online duration: 1 hour 40 minutes 46 seconds

[0156] Port-down keep online:Disabled(offline)

[0157] Still Figure 3 As shown, when terminal user 2 (0010-9418-0002) accesses the network, the M-LAG B device processes the user's authentication request (if the M-LAG A device receives the authentication request first, it will be forwarded to the B device for processing). After the authentication server returns a successful authentication message, the user's entry on the M-LAG B device is set to the Active state. Subsequently, the M-LAG B and the authentication server exchange authentication, authorization, and accounting messages for user 1. At this time, according to relevant technologies, the device B will allocate relevant hardware resources and occupy those resources.

[0158] If the M-LAG A device fails (including device failure, M-LAG A becoming unavailable due to uplink or downlink issues, etc.), the authentication entry for end user 1 (0010-9418-0001) on the M-LAG B device will be updated to Active, and a hardware entry will be immediately issued. Subsequently, M-LAG B will interact with the authentication server to exchange authentication, authorization, and accounting messages for user 1.

[0159] If M-LAG A recovers from its malfunction and re-establishes the M-LAG system with M-LAG B, the authentication entry for end user 1 (0010-9418-0001) on M-LAG B will be updated to Inactive. Simultaneously, a timer M-LAG_JR-Timer will be started (default value 12 minutes, configurable range 1-30 minutes). Once the M-LAG_JR-Timer expires, the hardware entry will be deleted, releasing hardware resources. At this point, the authentication entry for end user 1 (0010-9418-0001) on M-LAG A will be updated to Active, and a hardware entry will be immediately issued. After recovery on M-LAG A, end user 2 (0010-9418-0002) will remain in the Inactive state as before the malfunction, meaning no hardware entry will be issued. As shown in the table below, the absence of the on-demand parameter after Inactive indicates that the authenticated user is still occupying hardware resources. After the aging time is released, it will become Inactive (on-demand).

[0160] Entries within the M-LAG_JR-Timer aging period:

[0161] [M-LAG B]display mac-authentication connection user-mac 0010-9418-0001

[0162] Total connections: 1

[0163] Slot ID:1

[0164] User MAC address:0010-9418-0001

[0165] M-LAG NAS-IP type:Peer

[0166] M-LAG user state:Inactive

[0167] Access interface:Bridge-Aggregation3

[0168] Username:001094180001

[0169] User access state: Successful

[0170] Authentication domain:isp

[0171] IPv4 address:199.93.48.11

[0172] IPv4 address source:IP Source Guard

[0173] Initial VLAN:172

[0174] Authorization untagged VLAN:N / A

[0175] Authorization tagged VLAN:N / A

[0176] Authorization VSI:vsi3

[0177] Authorization microsegment ID:N / A

[0178] Authorization ACL number / name:N / A

[0179] Authorization dynamic ACL name:N / A

[0180] Authorization user profile:N / A

[0181] Authorization CAR:N / A

[0182] Authorization URL:N / A

[0183] Authorization IPv6 URL:N / A

[0184] Authorization temporary redirect:Disabled

[0185] Authorization redirect match terminal rule:N / A

[0186] Start accounting:Successful

[0187] Real-time accounting-update failures:0

[0188] Termination action:Default

[0189] Session timeout period: 86400 sec

[0190] Offline detection: Ignore (server - assigned)

[0191] Online from: 2024 / 08 / 29 15:42:59

[0192] Online duration: 2h 40m 46s

[0193] Port - down keep online: Disabled (offline)

[0194] Entries after M - LAG_JR - Timer aging time:

[0195] [M - LAG B]display mac - authentication connection user - mac 0010 - 9418 - 0001

[0196] Total connections: 1

[0197] Slot ID: 1

[0198] User MAC address: 0010 - 9418 - 0001

[0199] M - LAG NAS - IP type: Peer

[0200] M - LAG user state: Inactive (on - demand)

[0201] Access interface: Bridge - Aggregation3

[0202] Username: 001094180001

[0203] User access state: Successful

[0204] Authentication domain: isp

[0205] IPv4 address: 199.93.48.11

[0206] IPv4 address source: IP Source Guard

[0207] Initial VLAN:172

[0208] Authorization untagged VLAN:N / A

[0209] Authorization tagged VLAN:N / A

[0210] Authorization VSI:vsi3

[0211] Authorization microsegment ID:N / A

[0212] Authorization ACL number / name:N / A

[0213] Authorization dynamic ACL name:N / A

[0214] Authorization user profile:N / A

[0215] Authorization CAR:N / A

[0216] Authorization URL:N / A

[0217] Authorization IPv6 URL:N / A

[0218] Authorization temporary redirect:Disabled

[0219] Authorization redirect match terminal rule:N / A

[0220] Start accounting:Successful

[0221] Real-time accounting-update failures:0

[0222] Termination action:Default

[0223] Session timeout period:86400sec

[0224] Offline detection:Ignore(server-assigned)

[0225] Online from:2024 / 08 / 29 15:5759

[0226] Online duration: 2h 55m 46s

[0227] Port-down keep online:Disabled(offline)

[0228] After the M-LAG A fault and its recovery, terminal user 2 (0010-9418-0002) does not have to switch authentication status, therefore, no hardware resources are distributed during this process.

[0229] The M-LAG MAD function needs to be configured and ports reserved to prevent the M-LAG system from splitting, which will not be described in detail here in this embodiment.

[0230] When an access switch is connected to the M-LAG system, authentication is only performed on one M-LAG member device, and access authentication hardware resources are only used on that member device. The other end does not consume access authentication resources.

[0231] For example, see Figure 4 The diagram shown is a structural schematic of an authentication entry distribution device provided in an embodiment of this application. This device is applied to a first cross-device link aggregation (M-LAG) device in a network, wherein the M-LAG device is an authentication point (NAS) device in the network. The device includes:

[0232] The receiving unit 40 is used to receive a first authentication entry sent by the second M-LAG device indicating that the first user terminal has been successfully authenticated. The second M-LAG device generates the first authentication entry based on the message indicating that the first user terminal has been successfully authenticated after receiving the message from the authentication server.

[0233] The marking unit 41 is used to mark the first authentication entry as inactive, wherein when an authentication entry is marked as inactive, the authentication entry is not sent to hardware resources.

[0234] Optionally, the apparatus further includes a sending unit, a generating unit, and a sending unit:

[0235] The receiving unit 40 is further configured to receive an access authentication request sent by the second user terminal;

[0236] The sending unit is used to send the access authentication request to the authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request;

[0237] The receiving unit 40 is further configured to receive a message from the authentication server indicating that the second user terminal has been successfully authenticated;

[0238] The generation unit is used to generate a second authentication entry for successful authentication of the second user terminal based on the message indicating that the second user terminal has been successfully authenticated.

[0239] The marking unit 41 is further configured to mark the second authentication entry as active.

[0240] The issuing unit is used to issue the second authentication entry to the hardware resources.

[0241] Optionally, the sending unit is further configured to send the second authentication entry to the second M-LAG device, so that the second M-LAG device marks the second authentication entry as inactive.

[0242] Optionally, the receiving unit 40 is further configured to receive an authentication request sent by a third user terminal;

[0243] If it is determined that the authentication request sent by the third user terminal is an authentication request that needs to be processed locally, the sending unit is further configured to send the authentication request sent by the third user terminal to the authentication server for access authentication processing.

[0244] If it is determined that the authentication request sent by the third user terminal is an authentication request that the second M-LAG device needs to process, the sending unit is further configured to pass through the authentication request sent by the third user terminal to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to the authentication server for access authentication processing.

[0245] Optionally, the device further includes:

[0246] When a second M-LAG device malfunction is detected, the judgment unit is used to determine whether the sum of the number of locally maintained active authentication entries and inactive authentication entries is greater than the single device authentication specification of the local hardware resources.

[0247] If the determination unit determines that the sum of the number of authentication entries is greater than the single-device authentication specification of the local hardware resources, then the determination unit is used to determine a number of target authentication entries that meet preset conditions from the authentication entries in the inactive state, wherein the number of target authentication entries is the difference between the sum of the number of authentication entries and the single-device authentication specification of the local hardware resources.

[0248] The configuration unit is used to obtain the user access VLAN corresponding to each target authentication entry, delete the target authentication entry, and configure the authentication interface corresponding to the user as an authentication-free interface for the user access VLAN, so that when the user's traffic packet is received through the authentication interface, the user's traffic packet is forwarded based on the mapping relationship between the user access VLAN and VXLAN corresponding to the target authentication entry.

[0249] These units can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when one of these units is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these units can be integrated together to form a system-on-a-chip (SOC).

[0250] Furthermore, regarding the authentication entry issuance device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the authentication entry issuance device can be found in [reference needed]. Figure 5 As shown, the authentication entry issuing device may include: a memory 50 and a processor 51.

[0251] The memory 50 is used to store program instructions; the processor 51 calls the program instructions stored in the memory 50 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar, and will not be described again here.

[0252] Optionally, this application also provides an M-LAG device, including at least one processing element (or chip) for performing the above-described method embodiments.

[0253] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the above-described method embodiments.

[0254] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0255] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0256] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0257] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0258] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0259] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0260] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0261] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An authentication entry distribution method, characterized by, A first multi-device link aggregation (M-LAG) device applied to networking, wherein the M-LAG device is a network access server (NAS) device in the networking, and according to an M-LAG distributed parity authentication mode, odd MAC users are authenticated at a first M-LAG A device, and even MAC users are authenticated at a second M-LAG device; the method comprises: receiving a first authentication entry of a first user terminal authenticated successfully sent by the second M-LAG device, wherein the second M-LAG device generates the first authentication entry based on a message of the first user terminal authenticated successfully received from an authentication server, and synchronizes the first authentication entry to the first M-LAG device through an IPL link between the first M-LAG device and the second M-LAG device; marking the first authentication entry as a non-active state, wherein when an authentication entry is marked as a non-active state, the authentication entry is not issued to a hardware resource.

2. The method of claim 1, wherein, The method further comprises: receiving an access authentication request sent by a second user terminal, and sending the access authentication request to the authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request; receiving a message of the second user terminal authenticated successfully sent by the authentication server; generating a second authentication entry of the second user terminal authenticated successfully based on the message of the second user terminal authenticated successfully; marking the second authentication entry as an active state, and issuing the second authentication entry to a hardware resource.

3. The method of claim 2, wherein, The method further comprises: sending the second authentication entry to the second M-LAG device, so that the second M-LAG device marks the second authentication entry as a non-active state.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: receiving an authentication request sent by a third user terminal; if it is determined that the authentication request sent by the third user terminal is a local authentication request to be processed, sending the authentication request sent by the third user terminal to the authentication server for access authentication processing; if it is determined that the authentication request sent by the third user terminal is an authentication request to be processed by the second M-LAG device, transmitting the authentication request sent by the third user terminal to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to the authentication server for access authentication processing.

5. The method of claim 1, wherein, The method further comprises: when detecting a failure of the second M-LAG device, determining whether a sum of a number of authentication entries in an active state and a number of authentication entries in a non-active state maintained locally is greater than a single-device authentication specification of a local hardware resource; if it is determined that the sum of the number of authentication entries is greater than the single-device authentication specification of the local hardware resource, determining a plurality of target authentication entries satisfying a preset condition from the authentication entries in the non-active state, wherein a number of the target authentication entries is a difference between the sum of the number of authentication entries and the single-device authentication specification of the local hardware resource. For each target authentication table entry, a user access VLAN corresponding to the target authentication table entry is obtained, the target authentication table entry is deleted, and an authentication interface corresponding to the user is configured as an authentication-free authentication interface of the user access VLAN, so that when a traffic packet of the user is received through the authentication interface, the traffic packet of the user is forwarded based on a mapping relationship between the user access VLAN and the VXLAN corresponding to the target authentication table entry.

6. An authentication entry issuing apparatus characterized by comprising: The application relates to a first cross-device link aggregation (M-LAG) device applied to networking, wherein the M-LAG device is a network access server (NAS) device in the networking, and according to an M-LAG distributed odd-even authentication mode, odd MAC users are authenticated in a first M-LAG A device, and even MAC users are authenticated in a second M-LAG device. The receiving unit is configured to receive a first authentication table item of a first user terminal, which is sent by a second M-LAG device, wherein the second M-LAG device generates the first authentication table item based on a message of authentication success of the first user terminal after receiving the message of authentication success of the first user terminal sent by an authentication server, and synchronizes the first authentication table item to the first M-LAG device through an IPL link between the second M-LAG device and the first M-LAG device. The marking unit is configured to mark the first authentication table item as a non-active state, wherein when an authentication table item is marked as a non-active state, the authentication table item is not issued to a hardware resource.

7. The apparatus of claim 6, wherein, The device further comprises a sending unit, a generating unit and an issuing unit. The receiving unit is further configured to receive an access authentication request sent by a second user terminal. The sending unit is configured to send the access authentication request to an authentication server, so that the authentication server performs access authentication on the second user terminal based on the access authentication request. The receiving unit is further configured to receive a message of authentication success of the second user terminal sent by the authentication server. The generating unit is configured to generate a second authentication table item of authentication success of the second user terminal based on the message of authentication success of the second user terminal. The marking unit is further configured to mark the second authentication table item as an active state. The issuing unit is configured to issue the second authentication table item to a hardware resource.

8. The device of claim 7, wherein The sending unit is further configured to send the second authentication table item to the second M-LAG device, so that the second M-LAG device marks the second authentication table item as a non-active state.

9. The device of any one of claims 6-8, wherein The receiving unit is further configured to receive an authentication request sent by a third user terminal. If it is determined that the authentication request sent by the third user terminal is a local authentication request to be processed, the sending unit is further configured to send the authentication request sent by the third user terminal to an authentication server for access authentication processing. If it is determined that the authentication request sent by the third user terminal is an authentication request to be processed by the second M-LAG device, the sending unit is further configured to transparently transmit the authentication request sent by the third user terminal to the second M-LAG device, so that the second M-LAG device sends the authentication request sent by the third user terminal to an authentication server for access authentication processing.

10. The apparatus of claim 6, wherein, The apparatus further includes: A judging unit, when detecting the failure of the second M-LAG device, the judging unit is configured to judge whether the sum of the number of authentication table entries in the active state and the number of authentication table entries in the inactive state in the locally maintained authentication table entries is greater than the single-device authentication specification of the local hardware resource. A determining unit, if the judging unit determines that the sum of the number of authentication table entries is greater than the single-device authentication specification of the local hardware resource, the determining unit is configured to determine a number of target authentication table entries satisfying a preset condition from the authentication table entries in the inactive state, wherein the number of target authentication table entries is the difference between the sum of the number of authentication table entries and the single-device authentication specification of the local hardware resource. A configuring unit, for each target authentication table entry, the configuring unit is configured to obtain the user access Vlan corresponding to the target authentication table entry, delete the target authentication table entry, and configure the authentication interface corresponding to the user as the user access Vlan authentication exemption, so that when the traffic message of the user is received through the authentication interface, the traffic message of the user is forwarded based on the mapping relationship between the user access Vlan corresponding to the target authentication table entry and the VXLAN.

11. An authentication entry issuing apparatus characterized by comprising: The authentication table issuing apparatus includes: A memory configured to store program instructions; A processor configured to invoke the program instructions stored in the memory and perform the steps of the method according to any one of claims 1-5.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer executable instructions for causing the computer to perform the steps of the method according to any one of claims 1-5. The computer readable storage medium stores computer executable instructions for causing the computer to perform the steps of the method according to any one of claims 1-5.

Images