TRANSFER OF ROLE INFORMATION TO ACCESS SWITCHES

Abstract

A network switch (102-1, 150, 400), comprising: a processor (152, 401) and a non-transitory, computer-readable medium (154, 402) containing instructions (404, 406, 408, 410, 412) which, when executed by the processor, cause the network switch to: Receiving an authentication request message from a host device (110) connected to a first wireless access point, WAP, (103-1) connected to the network switch, the network switch being configured as a VXLAN tunnel endpoint, VTEP, in a Border Gateway Protocol, BGP, Ethernet Virtual Private Network, EVPN, based Virtual Extensible Local Area Network, VXLAN; Forwarding the authentication request message to an authentication server; In response to receiving an authentication response message from the authentication server, a role information is linked to the host device based on the authentication response message; Adding a role identifier to a route announcement message of the host device based on the role information, wherein the route announcement message indicates a mapping between an Internet Protocol (IP) address of the host device and a Media Access Control (MAC) address of the host device, wherein the network switch does the following to add the role identifier: Generating an extended BGP community field containing the role identifier that specifies the network access policies to be implemented for the host device; and Appending the extended BGP community field to the route announcement message; and Sending the route announcement message to another network switch (102-2), wherein the other network switch is configured as a peer VTEP in the VXLAN, and the network switch and the other network switch are configured in a single Virtual Local Area Network (VLAN), and wherein, upon receiving the route announcement message, the other network switch is aware of the network access policies to be implemented for the host device.

Description

BACKGROUND

[0001] Communication networks are often divided into three layers: a core layer, an access layer, and a distribution layer. The core layer provides high-speed communication for network devices such as switches and routers, which reside in the distribution and access layers. The access layer provides communication for host devices. The distribution layer acts as an interface between the core and access layers. It manages routing, filtering, and Quality of Service (QoS) policies for the communication network.

[0002] Communication network topologies can be built using physical connections between switches. Several physically connected switches can form a local area network (LAN). A collection of such LANs can form the network access layer. The switches in the access layer can be connected to one or more wireless access points (WAPs). The WAPs can serve as access points for wireless host devices.

[0003] CN 107911495 A concerns the field of communication technologies and in particular a MAC (Medium Access Control) address synchronization procedure and a VTEP (VxLAN Tunnel End Point).

[0004] The present invention is defined by independent claims 1, 9 and 19. Embodiments are the subject of the respective dependent claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] For a more comprehensive understanding of the present disclosure, examples in accordance with the various features described herein may be more easily understood by reference to the following detailed description in conjunction with the accompanying drawings, in which the same reference numerals denote the same structural elements and in which: Fig. Figure 1A schematically shows a computer network in which a wired network switch is implemented for the transmission of role information, according to an example; Fig. Figure 1B shows a block diagram of an exemplary network switch for the transmission of role information according to an example; Fig. Figure 1C schematically shows an extended BGP community field for sharing role information according to an example; Fig. 2 is a flowchart that shows a procedure for passing on role information according to an example; Fig. 3A and Fig. 3B Flowcharts are those that illustrate another procedure for passing on role information according to an example; and Fig. Figure 4 shows a computing device for carrying out the procedure for passing on role information according to an example.

[0006] Certain examples exhibit features that are present in addition to, or instead of, those depicted in the figures above. Certain labels may be omitted from specific figures for clarity. DETAILED DESCRIPTION

[0007] Communication networks, such as campus networks (CANs), can involve a connection between local area networks (LANs) and wireless access points (WAPs) connected to LAN switches. The switches can be connected to the WAPs via physical links. They can act as network connection points for the WAPs. A switch at the access layer, also called an access switch, can be connected to one or more WAPs. Each WAP can serve wireless host devices, such as laptops and mobile phones, within a specific area. For example, a WAP might serve a particular floor of a building on a campus where a CAN is deployed. A host device moving between different floors of the building can switch, or roam, between the WAPs serving those floors to maintain connectivity.

[0008] To enable seamless movement of host devices within the network, WAPs in some examples use fast roaming techniques. Fast roaming allows a mobile host device to move within the network without losing connection or dropping out. Fast roaming techniques can help host devices roam to a new WAP without re-authenticating. To avoid re-authenticating the host device, WAPs can share the host device's authentication information at the same access layer.

[0009] Host device information shared by WAPs can include network prefixes and IP addresses. To securely exchange such information, access switches often form Virtual Extensible Local Area Networks (VXLANs) that exchange control layer information over Ethernet Virtual Private Networks (EVPNs). Control layer information includes details in a switch routing table that determines how to handle incoming packets. VXLAN is a network virtualization technology that uses an encapsulation technique to encapsulate Open Systems Interconnection (OSI) Layer 2 Ethernet frames within Layer 4 Protocol (UDP) datagrams. VXLAN endpoints that terminate VXLAN tunnels and can be either virtual or physical switch ports are called VXLAN tunnel endpoints (VTEPs).EVPN is based on the Border Gateway Protocol (BGP), which enables the sharing of network prefixes and IP addresses in the form of Network Layer Reachability Information (NLRI). The access switches act as VTEPs, also known as VXLAN peers, exchanging BGP-EVPN update messages to share NLRI. Through this NLRI exchange, the access switches in the VXLAN know which host device is connected to which access switch via which WAP and forward the data accordingly.

[0010] Different host devices connecting to the network can be subject to different network policies depending on their role information. Network policies can include rules, permissions, conditions, and settings that determine which host devices are authorized to connect to the network and under what circumstances different host devices are allowed to connect. Role information indicates a group or category of host device users. The network policies applied to each host device can be set based on this role information. Examples of roles include: guest, student, employee, salesperson, executive, etc. Examples of network policies applied to such roles can include various conditions. For example, a "guest" mobile phone might be prohibited from using an office network for more than one hour.Another example: A "student" host can be denied access to certain URLs. With BGP-EVPN VXLANs implemented in the access switches, the access switches do not know the host device's role information, even though the host device's NLRI is shared by the access switches. This poses a challenge when implementing role-based network policies, especially when a host device roams from one WAP to another, with the first and second WAPs connected to two different access switches.

[0011] When a host device connects to a network for the first time, the initial WAP can receive role information. This is because role information can be provided to the WAP during authentication. For example, the WAP can act as a proxy for an authentication service such as RADIUS (Remote Authentication Dial-In User Service) or RADIUS over TLS (Transport Layer Security). However, when the host device roams from the first WAP to a second WAP at the same access layer, the second access switch to which the WAP is connected may not be aware of the host device's role. Access switches generally do not exchange information about the host device's role with each other.Although the host device can seamlessly switch between the first and second WAPs due to fast roaming, and data is correctly routed through the second WAP due to the sharing of NLRIs, the second access switch may not be able to enforce role-based network policies. Without proper enforcement of network policies at the second access switch, the conditions for data exchange with the host device may not be applied correctly. This can negatively impact overall network performance, throughput, and security. Furthermore, network nodes may exhibit vulnerabilities or become overloaded. This can lead to security threats or outages that affect service availability.

[0012] This disclosure describes techniques for incorporating host device role information into BGP update message announcements to share role information among access switches in a VXLAN network. Thus, when BGP update message announcements are exchanged between access switches, they also receive role information associated with specific host devices. This allows role information to be distributed between access switches. The access switches can then implement network policies based on this role information. This enables host devices to roam seamlessly between network switches while maintaining role-appropriate network policies. Furthermore, using the BGP-EVPN infrastructure to transmit role information avoids the overhead associated with a new communication protocol for role information.This can help to remove obstacles to scalability.

[0013] An example describes a network switch. The network switch, also called a switch, comprises a processor and a non-transitory, machine-readable medium containing instructions that, when executed by the processor, cause the switch to receive an authentication request message from a host device connected to a first WAP connected to the switch. The switch can be configured as a VTEP in a BGP-EVPN-based VXLAN. Other switches in the VXLAN can be configured as peer VTEPs. The switches can be configured in a single Virtual Local Area Network (VLAN) to enable fast roaming of host devices between WAPs connected to these switches. The switch forwards the authentication request message to an authentication server, such as a RADIUS server.In response to successful authentication of the host device, the switch assigns role information to the host device based on an authentication response message from the authentication server. Based on this role information, the switch adds a role identifier to a route announcement message from the host device. The route announcement message displays a mapping between the host device's IP (Internet Protocol) address and its MAC (Media Access Control) address. For example, to add the role identifier, the switch creates an extended BGP community field containing the role identifier, which specifies the network policies to be implemented for the host device, and appends this extended BGP community field to the route announcement message.The switch sends the route announcement message to another switch, and upon receiving the route announcement message, the other switch knows the network access policies to be implemented for the host device. If the host device switches from the first WAP to a second WAP connected to the other switch, the other switch knows the host device's role information based on the role identifier in the received route announcement message. Using the role identifier in the route announcement message, the other switch can configure its data layer to enforce the network policies for the host device and can accordingly route traffic to / from the host device connected to the second WAP.In this way, the host device's role information is passed between the switches, and the switches can consequently enforce network policies based on the host device's role, even if the host device is roaming via WAPs connected to different access switches.

[0014] The systems and procedures described can be implemented in various switches that perform the functions of a network switch at the access layer of a communication network. Although the above description refers to access switches, the described procedures and techniques can also be implemented in other types of switches that implement various communication technologies, albeit with some variations. Several implementations of this topic are described below using multiple examples.

[0015] The above-mentioned systems and procedures are described with reference to the Fig. 1A to Fig. 4. It should be noted that the description and figures merely illustrate the principles of the present subject matter together with the examples described herein and should not be interpreted as limiting the subject matter. It is therefore understood that various arrangements can be developed which, although not expressly described or shown here, embody the principles of the present subject matter. Furthermore, all statements contained herein that describe principles, aspects, and embodiments of the present subject matter, as well as specific examples thereof, are to be understood as also encompassing equivalents thereof.

[0016] Fig. Figure 1A schematically shows a computer network 100 according to an example from the present subject matter. The computer network 100 could be, for example, a public distributed environment, a private closed computer environment, etc. The computer network 100 can be implemented for an organization, such as a company, an educational institution, a government agency, a healthcare facility, or another type of organization. This diagram shows an example of a configuration implemented in an organization with multiple users (or at least multiple host devices). The computer network 100 can be implemented at a geographical location, which may include a primary network, such as an office network, a home network, or another type of network installation. The primary network may be a private network, for example,A network that can include security and access controls to restrict access to authorized users of the private network. Authorized users might include, for example, employees of a company at a specific geographic location, residents of a house, customers of a company, students at a school, etc. In one example, computer network 100 is a Campus Area Network (CAN).

[0017] According to an example from the present subject matter, the computer network 100 can comprise an access layer A, a distribution layer D, and a core layer C, as in Fig. Figure 1 shows that the access layer A can implement a variety of network switches, such as Switch 102-1, Switch 102-2, and Switch 102-3. For simplicity, Switch 102-1, Switch 102-2, and Switch 102-3 will be referred to collectively as Switches 102 in the following. Furthermore, the terms network switch and switch will be used interchangeably in this description. Each of the Switches 102 can provide connectivity to each other and between hosts. Each of the Switches 102 can be implemented as an access layer switching unit, a switch router, or any device capable of forwarding data packets at access layer A and providing connectivity between distribution layer D devices and host devices, as well as between host devices, without limitation.

[0018] Each Switch 102 can be connected to one or more WAPs. As shown in Fig. As shown in Figure 1, Switch 102-1 is connected to WAP 103-1, and Switch 102-2 is connected to WAPs 103-2 and 103-3. WAPs 103-1, 103-2, and 103-3 are collectively referred to as WAPs 103. In one example, each of the Switches 102 can be an access switch, allowing host devices to connect to the computer network 100. Each of the Switches 102 comprises multiple ports. In one example, a network administrator might refer to a port on a Switch 102 as a network port or a wireless access port. The network port acts as an interface between the Switch 102 and network devices at higher layers, such as layer D. The wireless access port acts as an interface between the Switches 102 and the WAPs 103 connected to the Switches 102.

[0019] The WAPs 103 are included as examples of access points to the computer network 100 for wireless host devices such as the host device 110. The WAPs 103 can control the network access of the host device 110 and enable authentication of the host device 110 for connecting to the WAPs 103 and, through the WAPs 103, to other devices within the computer network 100. The WAPs 103 can enable this authentication using the switches 102 and an authentication server, such as a RADIUS or RADSec server (not shown). Each of the WAPs 103 can be a combination of hardware, software, and / or firmware configured to provide wireless network connectivity for wireless host devices.In the example shown, the WAPs 103 can be implemented in a distributed WLAN architecture, in which the WAPs 103 provide independent distributed intelligence, but work together as a system to cooperatively provide control mechanisms.

[0020] Switches 102-1 and 102-2 are configured in a single broadcast domain. A broadcast domain can be understood as a logical subdivision of a computer network in which all nodes can reach each other via broadcast at the data transmission layer. A broadcast is the transmission of a data packet to every device in a network. A broadcast domain can be within the same LAN segment or bridge other LAN segments. For example, a single VLAN 120 is configured in switches 102-1 and 102-2. This allows, for instance, the configuration of a common VLAN identifier for the wireless access ports in each of switches 102-1 and 102-2, which are connected to WAPs 103-1, 103-2, and 103-3.

[0021] The distribution layer D comprises network devices 104-1 and 104-2 for managing connectivity between the wired network devices 102 in the access layer A and the core layer C. The core layer C can include network devices 106-1 and 106-2. Examples of network devices 106-1 and 106-2 include a router, a layer 3 switch, etc. The network devices 106-1 and 106-2 connect the devices of the distribution and access layers to a data center 108. The data center 108 can be connected to one or more devices in an external network or the Internet.

[0022] In Fig. Figure 1B shows an example network switch 150. The switch 150 can be connected to one or more of the ports shown in Fig. The switches shown in Figure 1A are similar to those in access layer A, such as Switch 102-1, Switch 102-2, and Switch 102-3. Switch 150 can contain a processor 152 and a memory 154, which can be interconnected via a communication link (e.g., a bus). The processor 152 can comprise one or more central processing units (CPUs) or other suitable hardware processors, such as a network ASIC. The memory 154 can be a machine-readable storage medium capable of storing machine-readable instructions that are executed by the processor 152. The memory 154 can comprise any suitable combination of volatile and / or non-volatile memory, such as combinations of random access memory (RAM), read-only memory (ROM), flash memory, and / or other suitable memory.

[0023] Memory 154 contains a non-transitory, computer-readable medium with instructions that can be executed by processor 152. Memory 154 stores instructions to be executed by processor 152, including instructions for authentication manager 156, role manager 158, and route manager 160.

[0024] Processor 152 can run authentication manager 156 to receive an authentication request message from a host device connected to a first WAP, which is connected to network switch 150. For example, network switch 150 can be configured as a VTEP in a BGP EVPN-based VXLAN. Authentication manager 156 can communicate with an authentication server, such as a RADIUS / RADSec server, and include a proxy authentication service. The authentication request message can be a RADIUS access request originating from the host device. The RADIUS access request can contain credentials such as a username and password or a user-provided security certificate, as well as the network address of the host device.

[0025] Processor 152 can execute authentication manager 156 to forward the authentication request message to the authentication server. Based on the credentials, the authentication server can authorize the host device for access. For example, in response to successful authentication of the host device, the authentication server can send an authentication response message to authentication manager 156 on network switch 150. The authentication response message could be, for example, a RADIUS: Access Acceptance message, indicating that network access has been granted to the host device. In another example, the authentication server could send back host device role information with the authentication response message. The host device role information specifies a purpose or function for which a user of the host device is connecting to the network.Network policies for accessing the host device are applied based on the host device's role information.

[0026] In response to successful authentication of the host device, processor 152 can execute role manager 158 to associate the role information with the host device based on the authentication response message from the authentication server. Associated role information with the host device includes implementing network policies on switch 150 based on the host device's role.

[0027] Furthermore, processor 152 can execute role manager 160 to insert a role identifier into a route announcement message from the host device, based on role information. The role identifier is an indicator of the network policies to be implemented for the host device. For example, the role identifier is a 16-bit value that specifies the role assigned to the host device during authentication. The route announcement can be a type 2 BGP-EVPN route that specifies a mapping between an IP (Internet Protocol) address and a MAC (Media Access Control) address of the host device. For instance, the route announcement might include a host device IP address mapped to a host device MAC address and an ARP (Address Resolution Protocol) entry.BGP is a routing protocol that makes dynamic routing decisions based on paths, network policies, and other factors, enabling the exchange of routing and reachability information between network devices, such as switches, connected via BGP. BGP allows two remote locations connected via a VPN tunnel to exchange routing information. EVPN can utilize a Multiprotocol BGP (MP-BGP) mechanism, defining a new sub-address family, such as an EVPN address family, within a Layer 2 VPN address family. An EVPN Network Layer Reachability Information (NLRI) can be added to the EVPN address family. The EVPN NLRI can define various types of BGP-EVPN routes, including information such as the host IP address, MAC address, and VXLAN Network Identifier (VNI).Once a Switch 102, acting as a VTEP, has learned the IP address and MAC address of a connected host, the VTEP can send this information to other switches (VTEPs) via BGP-EVPN routes. This allows the learning of host IP and MAC address information to be implemented in the control layer of a BGP-EVPN-based VXLAN. Control layer information can then be exchanged between Switch 102s using BGP-EVPN routes. Such a BGP-EVPN route, which contains a MAC address-to-IP address mapping for a host device, is called a Type 2 BGP-EVPN route.

[0028] Furthermore, processor 152 can execute role manager 160 to create an extended BGP community field that carries the role identifier. In an example, a BGP community comprises a group of targets that share a common property. Information about the BGP community is included as a path attribute in BGP update messages. BGP update messages are generally used between VTEPs in a BGP-EVPN-based VXLAN to exchange NLRI. The BGP community information identifies the community members and enables actions to be performed on the group of targets. The extended BGP community field can be vendor- or provider-specific.

[0029] Processor 152 can execute role manager 158 to append the extended BGP community field to the route announcement message. The route announcement message can be a BGP-EVPN type 2 route that specifies a mapping between the host device's IP (Internet Protocol) address and its MAC (Media Access Control) address. For example, appending the extended BGP community field could involve marking an attribute in a type 2 BGP-EVPN route shared by BGP-EVPN peers in a VXLAN.

[0030] Additionally, processor 152 can execute route manager 160 to send the route announcement message to another network switch. This other network switch is configured as a peer VTEP in the VXLAN. Upon receiving the route announcement message, the other switch knows the network access policies to be implemented for the host device. Both the network switch and the other network switch are configured in a single Virtual Local Area Network (VLAN).

[0031] To get back to Fig. To return to the first step, host device 110 can send an authentication request to WAP 103-1 to access network 100. Host device 110 can be a wireless host device capable of connecting to WAPs. Examples of host device 110 include a laptop, smartphone, tablet, etc. WAP 103-1 can forward the authentication request to switch 102-1. In one example, switch 102-1 can interact with an authentication server (not shown) to process the authentication request message. The authentication request can contain credentials such as the host device's username and password.

[0032] Based on the credentials, the authentication server, such as RADIUS, can validate the identity of the host device and authorize network access for that device. For example, an authentication manager 156 on switch 102-1 might include an authentication client proxy service that can forward the authentication request from host device 110 to the authentication server (not shown). The authentication server can maintain a central database of user profiles. The authentication server compares the user's credentials against this database. If a match is found, the authentication server can search for role information associated with the user.Role information indicates the group / category of the host device user connecting to the network, which is used to determine the network access policy or user profile. The authentication server can send an authentication response message indicating successful authentication of host device 110. This authentication response message may contain the role information of the host device user 110.

[0033] In response to the successful authentication of host device 110, switch 102-1 can associate the host device with role information based on the authentication response message from the authentication server. For example, the role manager 158 of switch 102-1 can configure the data layer of switch 102-1 to forward data based on the role information of host device 110, thus associating the role information with host device 110. The data layer (also called the forwarding layer) can comprise a combination of hardware and software within a switch that routes user traffic. The data layer enables data transfer to and from clients, the handling of multiple conversations over multiple protocols, and the management of conversations with remote endpoints.

[0034] Since switch 102-1 receives the authentication response message from the authentication server, and the authentication manager 156 on switch 102-1 contains an authentication client proxy service, switch 102-1 knows the role information of host device 110 upon receiving the authentication response message. For example, the role manager 158 of switch 102-1 can create a mapping between a MAC address of the host device and the role information, such as "Guest," from the authentication response message. In this example, the role identifier is a 16-bit numeric value that specifies the role information of the host device. The role manager 158 can retrieve a role identifier corresponding to the host device's role information from a role identifier table. The role identifier table can contain a mapping of role information to role identifiers.For example, the role identifier table can be stored in the switch 102-1 and predefined by a network administrator.

[0035] Additionally, role manager 158 can create an extended BGP community field containing the role identifier. In one example, the extended BGP community field is appended as an attribute to a route announcement message, such as an EVPN type 2 message, that NLRI publishes between BGP-EVPN peers in a VXLAN. In another example, the extended BGP community is a 4-octet value that can be divided into three main sections, as shown in Fig. Figure 1C shows the first octet of the extended BGP community field encodes a type field, the second octet a sub-type field, while the last two octets contain a unique record in a format defined by the type and sub-type fields.

[0036] In one example, the extended BGP community field is an opaque community field. In another example, role manager 158 defines a type of the extended BGP community field as (0*43), indicating that the community field is an extended community, and a subtype of the extended BGP community field as (0*03), indicating that it is an opaque field. The opaque field indicates that members categorized in the community are allowed to read the information in the community field, while non-members of the community, who cannot recognize the extended BGP community field, are configured to ignore it and forward the packet to its next hop. For example, community members include switches manufactured by a specific original equipment manufacturer (OEM).Switches from other OEMs that forward messages received by Switch 102-1 may not be able to read the extended community field. Because the extended BGP community field is opaque, such switches are configured to ignore the field and forward the packet to the next hop or destination. For example, the extended BGP community field is a non-transitive community field, meaning it is not applicable beyond the boundaries of an Autonomous System (AS). Additionally, Switch 102-1's role manager 158 appends the extended BGP community field to the route announcement message.

[0037] The route manager 160 of switch 102-1 then sends the route announcement message to another network switch. In one example, switch 102-1 sends the route announcement message in VLAN 120. Since switch 102-2 is part of VLAN 120, it receives the route announcement message, including the extended BGP community field with the role identifier. Upon receiving the route announcement message, the other network switch knows which network access policies to implement for the host device.

[0038] In response to receiving the route announcement message, the Switch 102-2 can create a host MAC address-to-role mapping based on the role identifier. This MAC address-to-role mapping can be stored in a switching table on the Switch 102-2. The switching table generally contains MAC addresses of host devices and the switch ports where the MAC addresses have been learned or statically configured. Upon receiving the route announcement message, the MAC role mapping can be added to the Switch 102-2's switching table. Frames are forwarded by looking up the destination MAC address in the switching table. The frames are then sent via the appropriate switch port.

[0039] Let us assume that host device 110 leaves the range of WAP 103-1 and enters the range of WAP 103-2, as indicated by arrow 112. With reference to Fig. Figure 1A shows the dashed lines of host device 110 as it roams from WAP 103-1 to WAP 103-2. For example, a user of host device 110 might move from one floor of the building to another, causing host device 110 to roam from WAP 103-1 to WAP 103-2. Once host device 110 roams from WAP 103-1 to WAP 103-2, it can send a request to connect to WAP 103-2. In another example, WAP 103-2 can authenticate and connect to host device 110. In some other examples, the host device can use 110 roaming techniques and connect immediately to WAP 103-2 as soon as it moves out of range of WAP 103-1 and into range of WAP 103-2. This is called fast roaming, also known as IEEE 802.Fast BSS Transition (FT), also known as 11r, enables a host device to roam quickly in environments implementing WPA2 Enterprise security. This eliminates the need for the client device to re-authenticate with an authentication server, such as a RADIUS server, each time it moves from one WAP to another. In a fast roaming example, after host device 110 connects to WAP 103-1, host device 110 identifies itself as the authenticated device for all WAPs in the broadcast domain, such as VLAN 120. Fig. 1A. When a host device roams to a new WAP, information from the original mapping is passed to the new WAP to authenticate the host device. The new WAP therefore knows that the host device has already been authorized by the authentication server and thus does not need to repeat the entire authentication process, resulting in a faster connection to the new WAP.

[0040] In response to host device 110 switching from WAP 103-1 to WAP 103-2, which is connected to switch 102-2, and connecting to WAP 103-2, switch 102-2 can determine that host device 110 is locally connected to switch 102-2. A host device that is locally connected to a switch can thus be interpreted as being connected to a WAP that is connected to the switch. For example, switch 102-2 can scan the wireless access ports of switch 102-2 and, based on MAC address learning of WAP 103-2, determine that host device 110 is locally connected to switch 102-2. In response to the finding that host device 110 is locally connected to switch 102-2, switch 102-2 can compare the MAC address of host device 110 with entries in its switching table.If a match is found, Switch 102-2 can configure its data layer to enforce network policies for host device 110 based on the MAC address and role mapping. Thus, network policies associated with host device 110's role information can be implemented in Switch 102-2 in response to host device 110 transitioning from WAP 103-1 to 103-2, since host device 110's role information is already passed to Switch 102-2. Furthermore, in an example, Switch 102-2 can clear the network policies from its data layer in response to host device 110 disconnecting from WAP 103-2. Consequently, no hardware storage space in Switch 102-2's data layer is consumed for storing network policies when the host device is not locally connected to Switch 102-2.

[0041] Fig. Figure 2 is a flowchart illustrating a procedure 200 for passing role information in switches according to an example. The procedure 200 can be executed on a wired network switch, e.g., switch 102-1 in an access layer A of a computer environment 100 ( Fig. 1).

[0042] In Block 202, a switch can receive an authentication request message from a host device connected to a first WAP connected to the switch. In one example, the switch is configured as a VTEP in a BGP-EVPN-based VXLAN. The switch can be one of several switches in an access layer of a CAN. Each of the multiple switches can be configured to perform the Block 202 procedure. The host device can send the authentication request to establish a connection to the network.

[0043] In block 204, the switch can forward the authentication request message to an authentication server, such as a RADIUS server. For example, the switch can act as an authentication proxy service, forwarding and receiving authentication messages on behalf of the host device.

[0044] In block 206, the switch can associate role information with the host device in response to successful authentication, based on an authentication response message from the authentication server. For example, the authentication response message from the authentication server can contain the role information.

[0045] In block 208, the switch can insert a role identifier into a route announcement message of the host device based on the role information. For example, the switch can create an extended BGP community field containing the role identifier, which indicates the network policies to be implemented for the host device, and can associate this extended BGP community field with the route announcement message.

[0046] In block 210, the switch can send the route announcement message to another network switch, where the other network switch is configured as a peer VTEP in the VXLAN. In one example, the network switch and the other network switch are configured in a single VLAN. Upon receiving the route announcement message, the other network switch knows the network access policies to be implemented for the host device.

[0047] Fig. Figure 3 is a flowchart illustrating a procedure 300 for passing role information in switches according to an example. The procedure 300 can be executed on a wired switch, e.g., switch 102-1 in an access layer A of a computer environment 100 ( Fig. 1).

[0048] Let's assume there are several interconnected switches in the network's access layer. The switch can receive an authentication request message in block 302 from a host device connected to a first WAP associated with the switch. In one example, the switch can interact with an authentication server (not shown) to process the authentication request message. The authentication request message can contain credentials, such as a username and password for a user of the host device. The switch forwards the authentication request to the authentication server in block 304.

[0049] Based on the login credentials, the authentication server, such as RADIUS, can validate the identity of the host device user and authorize network access for that user. For example, the switch might include an authentication client proxy service that forwards the authentication request message from the host device to the authentication server. The authentication server can maintain a central database of user profiles. It compares the user's login credentials against this database. If there is a match, the authentication server can check whether the user has any assigned role information. This role information identifies the group / category of the host device user connecting to the network, which determines the network access policy or user profile.The authentication server can send an authentication response message indicating successful authentication of the host device. The switch can check in block 306 whether the authentication was successful. Upon receiving the authentication response message indicating successful authentication from the authentication server, the switch can determine that the authentication was successful (the "yes" branch of block 306). If the message indicating successful authentication is not received, the switch determines that the authentication failed (the "no" branch of block 306) and can check for authentication requests from other host devices in block 308.

[0050] In response to successful authentication of the host device, the switch can associate the role information with the host device based on the authentication response message from the authentication server. Therefore, the switch in block 310 can configure its data layer to process data to / from the host device based on the host device's role, thus associating the role information with the host device.

[0051] Because the switch receives the authentication response message from the authentication server, it knows the role information contained in the authentication response message. In block 312, the switch can create a mapping between a host device's MAC address and the role information, such as "Guest," from the authentication response message. In one example, the role identifier is a 16-bit numeric value that indicates the host device's role. In block 314, the switch can retrieve a role identifier corresponding to the host device's role information from a role identifier table. The role identifier table can contain a mapping of role information to role identifiers. In one example, the role identifier table can be stored on the switch and predefined by a network administrator.

[0052] In block 316, the switch can create an extended BGP community field that carries the role identifier. In one example, the extended BGP community field is appended as an attribute to a route announcement message, such as an EVPN type 2 message, that NLRI publishes between BGP EVPN-based peer VTEPs in a VXLAN. In this example, the extended BGP community is a 4-octet value that can be divided into three main sections. The first octet of the extended BGP community field encodes a type field, the second octet a sub-type field, while the last two octets contain a unique record in a format defined by the type and sub-type fields.

[0053] In one example, the extended BGP community field is an opaque community field. In this example, the switch defines one type of the extended BGP community field as (0*43), indicating that the community field is an extended community, and a subtype of the extended BGP community field as (0*03), indicating that it is an opaque field. The opaque field indicates that members categorized in the community are allowed to read the information in the community field, while non-members of the community, who cannot recognize the extended BGP community field, are configured to ignore it and forward the packet to its next hop. For example, community members might include switches manufactured by a specific original equipment manufacturer (OEM).Switches from other OEMs that forward messages received by the switch may not be able to read the extended community field, and because the extended BGP community field is opaque, such switches ignore the field and forward the packet to the next hop. An example of the extended BGP community field is shown in [document / reference]. Fig. 1C is shown. The switch then appends the extended BGP community field in block 318 to the route announcement message.

[0054] In block 320, the switch sends the route announcement message in its broadcast domain. This allows other switches in the same broadcast domain to receive the route announcement message with the extended BGP community field. Upon receiving the route announcement message, the other network switches are aware of the network access policies to be implemented for the host device.

[0055] Fig. Figure 3B illustrates the steps of procedure 300 as performed by another switch that receives the route announcement message. As shown in Fig. As shown in Figure 3B, another switch in the broadcast domain, in response to receiving the route announcement message in block 322, creates a mapping between the host MAC address and role based on the role identifier. This MAC address-to-role mapping can be stored in a switching table on the other switch. The switching table generally contains MAC addresses of host devices and the switch ports where the MAC addresses have been learned or statically configured. Upon receiving the route announcement message, the MAC role mapping can be added to the switching table of switch 102-2. Frames are forwarded by looking up the destination MAC address in the switching table. The frames are then sent via the appropriate switch port.

[0056] Let's assume the host device leaves the range of the first WAP and enters the range of a second WAP connected to the other switch. For example, a user of the host device might move from one floor of the building to another, causing the host device to roam from the first WAP to the second. Once the host device moves from the first WAP to the second, it can send a request to connect to the second WAP. In one example, the second WAP can authenticate the host device and connect to it. In other examples, the host device can use fast roaming techniques and connect to the second WAP immediately upon leaving the range of the first WAP and entering its range.

[0057] In block 324, the switch can scan its wireless access ports. Using the MAC learning data from the second WAP, the switch can check if the host device's MAC address matches any of the MAC addresses learned for one of its wireless access ports. If a match is found, the switch can determine in block 326 that the host device is locally connected to it. A host device locally connected to a switch can be interpreted as the host device being connected to a WAP attached to the switch. Based on this determination, the switch can compare the host device's MAC address with entries in its switching table in block 328. If a match is found, the switch can configure its data layer in block 330 to enforce network policies for the host device based on the MAC address and role mapping.In this way, network policies associated with the host device's role information can be implemented on the other switch when the host device roams from the first WAP to the second WAP. This is because the host device's role information has already been passed to the other switch with the route announcement message. In response to the host device roaming from the first WAP to the second WAP, the other switch can enforce the host device's network policies based on the host device's role information, which is obtained as a result of the MAC address-to-role mapping created by the other switch.

[0058] Fig. Figure 4 is an example of a computing device 400 with a hardware processor 401 and accessible machine-readable instructions stored on a machine-readable medium 402 for implementing an example system according to one or more disclosed example implementations. In one example, the computing device 400 can be a network switch, such as the switch 102 described above with reference to Fig. 1 was described. Fig. Figure 4 shows the computing device 400 configured to execute instructions 404-412 described below. However, the computing device 400 can also be configured to perform other procedures, techniques, functions, or processes described in this disclosure, such as procedure 200 from Fig. 2.

[0059] A processing element such as the Processor 401 can contain one or more hardware processors, each of which can have one or more processor cores. In one embodiment, the Processor 401 can contain at least one shared cache that stores data (e.g., computational instructions) used by one or more other components of the Processor 401. The shared cache can, for example, consist of locally cached data stored in a memory for faster access by the components of the processing elements that make up the Processor 401. In one or more embodiments, the shared cache can include one or more mid-level caches, such as Level 2 (L2), Level 3 (L3), Level 4 (L4), or other cache levels, a Last-Level Cache (LLC), or combinations thereof. Examples of processors include, but are not limited to, the following:a central processing unit (CPU), a microprocessor. Although in . Fig. Not shown in Figure 4, the processing elements comprising the 401 processor may also include one or more other types of hardware processing components, such as graphics processing units (GPUs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) and / or digital signal processors (DSPs).

[0060] The 401 processor can be operationally and communicatively connected to memory. Memory can be a non-transient, computer-readable medium, such as the 402 machine-readable memory medium, configured to store various types of data. For example, memory can include one or more memory devices, which may include a non-volatile memory device and / or volatile memory. Volatile memory, such as random access memory (RAM), can be any suitable non-volatile memory device. Non-volatile memory devices can include one or more hard disk drives, optical drives, solid-state drives (SSDs), tap drives, flash memory, read-only memory (ROM), and / or any other type of memory designed to retain data for a period of time after a power failure or shutdown process.In certain cases, non-volatile storage devices can be used to store overflow data when the allocated RAM is not large enough to hold all the working data. Non-volatile storage devices can also be used to store programs that are loaded into RAM when such programs are selected for execution.

[0061] The machine-readable storage medium 402 from Fig. 4. The machine-readable storage medium can include both volatile and non-volatile, removable and non-removable media, and can be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions, data structures, program modules, or other data accessible to a processor, such as firmware, erasable programmable read-only memory (EPROM), random-access memory (RAM), non-volatile random-access memory (NVRAM), optical disks, solid-state drives (SSDs), flash memory chips, and the like. The machine-readable storage medium can be a non-transient storage medium, the term "non-transient" excluding any transitory transmission signals.

[0062] The machine-readable medium 402 contains instructions 404 which, when executed by processor 401, cause a switch to receive an authentication request message from a host device connected to a first WAP connected to a switch. The switch is configured as a VTEP in a BGP-EVPN-based VXLAN.

[0063] Instructions 406, when executed by processor 401, instruct the switch to forward the authentication request message to an authentication server. Upon successful authentication of the host device, instructions 408, when executed by processor 401, instruct the switch to associate role information with the host device, based on an authentication response message from the authentication server. Instructions 410, when executed by processor 401, instruct the switch to add a role identifier to a route announcement message from the host device, based on this role information. For example, the switch might create an extended BGP community field containing the role identifier, which indicates the network policies to be implemented for the host device, and append this extended BGP community field to the route announcement message.When executed by processor 401, instructions 412 cause the switch to send a route announcement message to another network switch, which is configured as a peer VTEP in the VXLAN. The switch and the other network switch are configured in a single virtual local area network (VLAN). Upon receiving the route announcement message, the other network switch is aware of the network access policies to be implemented for the host device.

[0064] A network switch, or a switch like those used in the examples mentioned here, forwards data (in control packets) between a sending device and a receiving device (or multiple receiving devices) based on forwarding information (or equivalent "routing information") that the switch can access. The forwarding information can include entries that map network addresses (such as MAC addresses or IP addresses) and / or ports to corresponding network paths to the receiving device(s).

[0065] WAPs are an example of an access point to a network, such as network 100. Fig.1. The WAPs can control network access for host devices and authenticate the host devices for connection to the WAPs and, through the WAPs, to other devices within the network. Each WAP can be a combination of hardware, software, and / or firmware configured to provide wireless network connectivity for wireless host devices. In the example shown, the WAPs can be managed and configured by a controller. The WAPs communicate with the controller and the network via connections, which can be wired or wireless interfaces.

[0066] In this description and the claims, certain terms are used that refer to specific system components. As those skilled in the art know, different parties may refer to a component by different names. This document does not intend to distinguish between components that differ in name but not in function. In this disclosure and in the claims, the terms "including" and "comprehensive" are used in an open manner and should therefore be interpreted as meaning "including, but not limited to...". Furthermore, the term "couple" or "connect" is intended to mean either an indirect or a direct wired or wireless connection. Thus, when a first device is coupled to a second device, this connection can be made by a direct connection or by an indirect connection via other devices and connections.The phrase "based on" is meant to mean "based at least partially on". Therefore, if X is based on Y, then X can be a function of Y and any number of other factors.

[0067] The above explanations are intended to illustrate the principles and various implementations of the present disclosure. Numerous variations and modifications will become apparent to the person skilled in the art once the above disclosure is fully understood. It is intended that the following claims be interpreted to encompass all such variations and modifications.

Claims

[1] A network switch (102-1, 150, 400), comprising: a processor (152, 401) and a non-transitory, computer-readable medium (154, 402) containing instructions (404, 406, 408, 410, 412) which, when executed by the processor, cause the network switch to: Receiving an authentication request message from a host device (110) connected to a first wireless access point, WAP, (103-1) connected to the network switch, the network switch being configured as a VXLAN tunnel endpoint, VTEP, in a Border Gateway Protocol, BGP, Ethernet Virtual Private Network, EVPN, based Virtual Extensible Local Area Network, VXLAN; Forwarding the authentication request message to an authentication server; In response to receiving an authentication response message from the authentication server, a role information is linked to the host device based on the authentication response message; Adding a role identifier to a route announcement message of the host device based on the role information, wherein the route announcement message indicates a mapping between an Internet Protocol (IP) address of the host device and a Media Access Control (MAC) address of the host device, wherein the network switch does the following to add the role identifier: Generating an extended BGP community field containing the role identifier that specifies the network access policies to be implemented for the host device; and Appending the extended BGP community field to the route announcement message; and Sending the route announcement message to another network switch (102-2), wherein the other network switch is configured as a peer VTEP in the VXLAN, and the network switch and the other network switch are configured in a single Virtual Local Area Network (VLAN), and wherein, upon receiving the route announcement message, the other network switch is aware of the network access policies to be implemented for the host device. [2] The network switch according to claim 1, wherein the extended BGP community field is an opaque community field. [3] The network switch according to claim 1, wherein the extended BGP community field is a non-transitive community field. [4] The network switch according to claim 1, wherein the route announcement message is a BGP-EVPN type 2 route. [5] The network switch according to claim 1, wherein the extended BGP community field comprises four octets. [6] The network switch according to claim 1, wherein the role identifier is a sixteen-bit value starting with the least significant bit of the extended BGP community field. [7] The network switch according to claim 1, wherein the extended BGP community field comprises: Type information indicating that the extended BGP community field is a non-transitive opaque extended community; and Subtype information indicating that the extended BGP community field carries the role identifier. [8] The network switch according to claim 1, wherein the network switch is an access switch at a customer edge. [9] A procedure that includes the following: through a network switch (102-1, 150, 400), receiving an authentication request message from a host device (110) associated with a first wireless access point, WAP, (103-1) connected to the network switch, the network switch being configured as a VXLAN tunnel endpoint, VTEP, in a Border Gateway Protocol, BGP, Ethernet Virtual Private Network, EVPN, based Virtual Extensible Local Area Network, VXLAN; Forwarding the authentication request message through the network switch to an authentication server; In response to successful authentication of the host device, the network switch links role information to the host device based on an authentication response message from the authentication server; Adding, through the network switch, a role identifier to a route announcement message of the host device based on the role information, wherein the route announcement message indicates a mapping between an Internet Protocol (IP) address of the host device and a Media Access Control (MAC) address of the host device, wherein adding the role identifier includes: Generating an extended BGP community field containing the role identifier that specifies the network policies to be implemented for the host device; and Appending the extended BGP community field to the route announcement message; and Sending the route announcement message by the network switch to another network switch (102-2), wherein the other network switch is configured as a peer VTEP in the VXLAN, the network switch and the other network switch are configured in a single Virtual Local Area Network, VLAN, and wherein, upon receiving the route announcement message, the other network switch knows the network access policies to be implemented for the host device. [10] The method according to claim 9, wherein the extended BGP community field is an opaque community field. [11] The method according to claim 9, wherein the extended BGP community field is a non-transitive community field. [12] The method according to claim 9, wherein the route announcement message is a BGP-EVPN type 2 route. [13] The method according to claim 9, wherein the extended BGP community field comprises four octets. [14] The method according to claim 9, wherein the extended BGP community field comprises: Type information indicating that the extended BGP community field is a non-transitive opaque extended community; and Subtype information indicating that the extended BGP community field carries the role identifier. [15] The method according to claim 9, wherein the network switch is an access switch at a customer edge. [16] The method according to claim 9, further comprising that the other network switch creates a mapping of host MAC addresses, Media Access Control, to roles based on the role identifier obtained from the route announcement message received by the network switch. [17] The method according to claim 16, further comprising enforcing network policies of the host device by the other network switch and as a result of creating the MAC address role mapping, based on the role of the host device, in response to the roaming of the host device from the first WAP to a second WAP (103-2) connected to the other network switch. [18] The method according to claim 16, further comprising configuring a data plane by the other network switch to enforce network policies for the host device based on MAC address role assignment in response to the host device roaming from the first WAP to a second WAP connected to the other network switch. [19] A non-transitory, computer-readable medium (154, 402) containing instructions (404, 406, 408, 410, 412) which, when executed by a processor (152, 401), cause a network switch (102-1, 150, 400) to: Receiving an authentication request message from a host device (110) associated with a first wireless access point (WAP, 103-1) connected to the network switch, the network switch being configured as a VXLAN tunnel endpoint (VTEP) in a Border Gateway Protocol (BGP) or Ethernet Virtual Private Network (EVPN) based Virtual Extensible Local Area Network (VXLAN); Forwarding the authentication request message to an authentication server; In response to successful authentication of the host device, a role information is linked to the host device based on an authentication response message from the authentication server; Adding a role identifier to a route announcement message of the host device based on the role information, wherein the route announcement message indicates a mapping between an Internet Protocol (IP) address of the host device and a Media Access Control (MAC) address of the host device, wherein the network switch does the following to add the role identifier: Generating an extended BGP community field containing the role identifier that specifies the network policies to be implemented for the host device; and Appending the extended BGP community field to the route announcement message; and Sending the route announcement message to another network switch (102-2), wherein the other network switch is configured as a peer VTEP in the VXLAN, the network switch and the other network switch are configured in a single Virtual Local Area Network, VLAN, and wherein, upon receiving the route announcement message, the other network switch knows the network access policies to be implemented for the host device. [20] The non-transitive computer-readable medium according to claim 19, wherein the extended BGP community field is an opaque and non-transitive community field.

Images