Campus Traffic Policy Compaction via Access Tagging and Border Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Access layer switches in campus networks lack the capability to distinguish between internal and external destinations, making it difficult to enforce destination-based network segmentation policies, particularly blanket external traffic denial policies, due to hardware limitations and scalability issues.
Innovation Solution
Distribute policy enforcement between access layer switches and border switches, where access layer switches tag packets when no specific policies apply, and border switches enforce catch-all policies based on destination, using VxLAN headers for tagging and distinguishing internal vs. external traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If access layer switches enforce destination-based network segmentation policies, then policy enforcement capability is improved, but device complexity and hardware resources increase
Solution Approach 1:
The patent divides the network into access layer and border layer, with each layer having distinct responsibilities. Access layer switches handle local policy enforcement for directly connected devices, while border switches handle destination-based policies for remote devices. This segmentation allows access layer switches to maintain simplicity while the network as a whole achieves destination-based segmentation capability.
Solution Approach 2:
The patent introduces border switches as intermediary devices between access layer switches and external networks. These border switches possess the destination-based policy enforcement capability that access layer switches lack, acting as a mediator that provides the needed functionality without requiring every access layer switch to have complex hardware resources.
2Adaptability or versatility
If access layer switches store comprehensive policy entries for all destinations, then policy coverage is improved, but scalability deteriorates
Solution Approach 1:
The patent segments the policy enforcement function between access layer switches (handling local device policies) and border switches (handling destination-based policies). This segmentation allows the network to scale because access layer switches maintain minimal local policy entries while border switches handle comprehensive destination-based policies, avoiding the need to replicate large policy databases across all access switches.
Solution Approach 2:
The border switch serves multiple functions: it acts as a policy enforcement point for destination-based segmentation, serves as a gateway to external networks, and provides the destination information that access layer switches cannot determine. This multi-functionality consolidates complexity at the border layer while maintaining scalability at the access layer.
3Measurement precision
If access layer switches are equipped with destination identification capability, then policy accuracy is improved, but device complexity increases
Solution Approach 1:
The patent segments the destination identification function from the access layer switches and places it at the border layer. Access layer switches only need to identify local devices (which they can do using existing MAC address tables), while border switches perform destination identification for external and remote destinations. This segmentation maintains policy accuracy while preserving access layer simplicity.
Solution Approach 2:
The border switch uses its inherent routing table and connection information to self-determine whether destinations are internal or external, without requiring additional hardware resources at access layer switches. The border switch's position in the network topology provides it with the information needed to make destination identification decisions autonomously.
Data Source
AI summary
A system for compacting traffic separation policies in campus networks, the system comprising an access layer switch and a campus border switch. The access layer switch is configured to receive a definition of one or more policies; responsive to receiving a packet, determine whether any of the policies apply to the packet; responsive to determining that none of the policies apply, cause a tag to be inserted into a communication header of the packet and forward the packet; and responsive to determining that one of the policies applies, forward or drop the packet according to the applicable policy and omit the tag. The campus border switch is configured to, responsive to receiving a packet from the access layer switch, determine whether the packet includes the tag, and responsive to determining that the packet includes the tag, apply a traffic separation policy associated with the tag to the packet.