VTEP Dynamic AC Interface Creation for VXLAN Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VXLAN network access control methods require pre-created Attachment Circuit (AC) interfaces and involve complex network configurations, including a layer-2 switch for authentication, which increases network complexity and resource usage.
Innovation Solution
A VTEP device and method that dynamically creates an AC interface without pre-creation, using an authentication server to authenticate users and associate AC interfaces with authorization information, eliminating the need for a layer-2 switch and reducing network complexity by directly communicating with user terminals via layer-3 routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-created AC interfaces are used on each physical port of the VTEP, then access control can be performed, but network configuration complexity increases
Solution Approach 1:
The patent implements dynamic creation of AC interfaces based on authentication results. Instead of pre-creating static AC interfaces on all physical ports, the system dynamically creates AC interfaces only when needed during user authentication processes. This dynamic approach reduces configuration complexity while maintaining access control functionality, as AC interfaces are created on-demand rather than being permanently configured on every port.
2Reliability
If a layer-2 switch is provided between VTEP and user terminal for authentication, then user authentication can be performed, but hardware resource usage increases
Solution Approach 1:
The patent merges the authentication functionality into the VTEP device itself, eliminating the need for a separate layer-2 switch dedicated to authentication. The VTEP integrates the authentication server or connects directly to it, combining multiple functions (VXLAN tunneling and authentication) into a single device or closely coupled system. This consolidation reduces hardware resource usage by removing redundant layer-2 switches while maintaining authentication capabilities.
3Productivity
If AC interfaces are pre-created on each physical port, then VXLAN encapsulation can be performed, but configuration effort increases
Solution Approach 1:
The system implements self-service through automatic AC interface creation triggered by authentication events. When a user successfully authenticates, the system automatically creates the necessary AC interface and associates it with the appropriate VXLAN configuration. This eliminates manual configuration efforts for each AC interface while ensuring proper VXLAN encapsulation settings are applied, as the system configures itself based on authentication results rather than requiring pre-manual setup of all interfaces.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A VXLAN Tunnel End Point (VTEP) sends an authentication request packet to an authentication server upon receiving a user access request from a user terminal, so as to cause the authentication server to perform an authentication for a user. The VTEP receives authorization information of the user for which the authentication is passed. The authorization information is sent by the authentication server, and includes a Virtual Switch Instance (VSI) identifier or a Virtual extensible LAN (VXLAN) identifier. The VTEP creates an Attachment Circuit (AC) interface on a user port connecting the user terminal of the VTEP. The VTEP associates the AC interface with the authorization information.