VXLAN Access Control via IP-Based Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In VXLAN networks, the inability to determine the actual port used by a service router to receive VXLAN packets leads to authentication failures, as pre-configuration of authentication information is not possible, hindering user authentication and network access.
Innovation Solution
An access control method that encapsulates IP request packets into VXLAN request packets, including the IP address of the access device, which is then parsed and sent to an authentication server for user authentication, allowing pre-configuration of authentication rules based on unique access device IP addresses, ensuring secure and reliable user authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If VXLAN packets are sent using equal-cost multi-path routing (ECMP), then network load balancing is improved, but the ability to determine the actual receiving port is lost, making authentication impossible
Solution Approach 1:
The patent introduces VXLAN request packets as an intermediary mechanism that carries authentication information from the access device to the authentication server. This intermediary packet enables the authentication process to function properly even when ECMP routing makes direct port determination impossible, thus resolving the contradiction between load balancing and authentication reliability
Solution Approach 2:
The patent implements preliminary configuration of authentication rules in the authentication server based on access device IP addresses before actual user authentication occurs. This preliminary action allows the system to prepare authentication credentials in advance, overcoming the problem of not being able to determine the actual receiving port during ECMP routing
2Ease of operation
If authentication information is pre-configured based on physical location, then user authentication is simplified, but this approach cannot work in VXLAN scenarios where physical location cannot be determined
Solution Approach 1:
The patent changes the authentication parameter from physical location information to access device IP address information. This parameter change allows authentication to work in VXLAN environments where physical location is not accessible, while maintaining the simplicity of pre-configuration. The authentication server stores credentials indexed by access device IP addresses instead of physical locations
Solution Approach 2:
Instead of determining physical location from the receiving port (traditional approach), the patent inverts the logic by using the access device IP address (which is always available in VXLAN packets) as the basis for authentication. This inversion makes the authentication system adaptable to VXLAN scenarios while maintaining ease of operation
Data Source
Figure 1~2
Figure 3
Figure 4-1
AI summary
The present invention discloses an access control method, apparatus, and system, and belongs to the communications field. The method includes: receiving a virtual extensible local area network VXLAN request packet sent by an access device; parsing the VXLAN request packet to obtain an IP address of the access device and authentication information of a user; sending the IP address of the access device and the authentication information of the user to an authentication server, so that the authentication server authenticates the user; receiving an authentication result sent by the authentication server; and controlling the user according to the authentication result. According to the present invention, the user is authenticated according to access information of the user in a VXLAN scenario.