VLAN Client Isolation via Switch-Based Group Marking

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In fabric networks, particularly those using Virtual Local Area Networks (VLANs), there is a challenge in isolating client devices to prevent direct communication between them, especially when they belong to a protected group, while allowing communication between devices in promiscuous VLANs, without relying on firewalls for every possible combination of client interactions.

Innovation Solution

Implementing a switching device that determines whether client devices belong to a protected or promiscuous group by examining data packets and blocking forwarding of data between devices in the same protected group, using VLAN and Ethernet Virtual Instance markings to isolate traffic within the network fabric.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If firewalls are used to control every possible combination of client interactions, then network security is improved, but device complexity and configuration difficulty increase significantly

Engineering Contradiction:

Improvenetwork securityVSAvoidfirewall configuration complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The network is segmented into protected VLANs and promiscuous VLANs, with further division into protected groups within each VLAN. This segmentation allows automatic isolation of clients in protected groups without requiring complex firewall rules for every client pair, as the VLAN and group structure inherently enforces isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism (the protected group marking and isolation logic in the network switch) that automatically enforces isolation policies. Instead of using firewalls as intermediaries to inspect and filter every packet between clients, the switch itself acts as an intermediary that drops packets between clients in the same protected group, simplifying the architecture.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If manual firewall rules are configured for each client interaction, then precise traffic control is achieved, but ease of operation and maintenance deteriorate

Engineering Contradiction:

Improvetraffic control precisionVSAvoidfirewall rule management

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system enables self-service automatic isolation of clients in protected groups. The network switch automatically identifies clients belonging to protected groups and enforces isolation policies without requiring manual configuration of individual firewall rules. The protected group markings and isolation logic are applied automatically based on VLAN and group membership.

Inventive Principle:

Principle #25Self-service

3Ease of operation

If all clients in a VLAN can communicate freely, then ease of operation is maintained, but network security deteriorates due to inability to isolate protected clients

Engineering Contradiction:

Improvenetwork communication simplicityVSAvoidclient isolation security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

Different quality levels of communication are applied locally to different client groups. Clients in protected groups within the same VLAN have their communications automatically isolated from each other, while clients in promiscuous VLANs maintain free communication. This local differentiation of communication permissions allows protected clients to be isolated without affecting the overall simplicity of network operation.

Inventive Principle:

Principle #3Local quality

4Reliability

If packet dropping is implemented between protected group clients, then client isolation is achieved, but loss of information occurs when legitimate traffic is blocked

Engineering Contradiction:

Improveclient isolation effectivenessVSAvoidlegitimate traffic blocking

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The network switch acts as an intermediary that intelligently drops packets between clients in the same protected group while allowing packets to reach external networks and other VLANs. The isolation logic is applied selectively only to intra-protected-group traffic, not to all traffic from protected clients. This prevents legitimate traffic loss while maintaining effective isolation.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11502872B1Isolation of clients within a virtual local area network (VLAN) in a fabric network

Publication Date: 2022.11.15 CISCO TECHNOLOGY INC

AI summary

Client device blocking may be provided. A switching device may receive data from a first client device. The data may be addressed to a second client device. Then it may be determined that both the first client device and the second client device belong to a protected group. Next, in response to determining that both the first client device and the second client device belong to the protected group, the data may be blocked from being forwarding to the second client device on a network interface of the switching device.