Service chain integration with a wireless local area network (WLAN)
Service chain integration with a Wireless Local Area Network (WLAN) may be provided. A computing device may send metadata from a wireless network to a Service Function (SF) selected from one of a plurality of SFs. Then the computing device may receive a control trigger from the SF in response to the metadata. The computing device may then perform a service action on the wireless network in response to the control trigger.
1 . A method comprising:
sending, by a Wireless Local Area Network (LAN) Controller (WLC), metadata from a wireless network to a Service Function (SF) selected from one of a plurality of SFs of a service chain, wherein sending the metadata comprises:
steering data packets of a session to the SF for a predetermined interval, and
adding Network Service Header (NSH) comprising the metadata to the data packets;
receiving, by the WLC, a control trigger from the SF in response to the metadata; and
performing, by the WLC, a service action on the wireless network in response to the control trigger.
2 . The method of claim 1 , wherein performing the service action comprises termination of the session when a malicious flow is detected by the SF.
3 . The method of claim 1 , wherein performing the service action comprises reserving specific scheduling resources on an air interface in the wireless network based on a Deep Packet Inspection (DPI) and application identifier as detected by the SF.
4 . The method of claim 1 , wherein performing the service action comprises applying a service function insertion on a client session on the wireless network.
5 . The method of claim 1 , wherein performing the service action comprises linking service chain events received over the NSH with signaling on the wireless network.
6 . The method of claim 1 , wherein performing the service action comprises restricting user-access based on at least one of a client device location, user role, and application identifier.
7 . The method of claim 1 , wherein performing the service action comprises quarantining of a client device for a certain time when an anomaly is detected.
8 . The method of claim 1 , wherein performing the service action comprises permitting access to certain applications based on user role.
9 . The method of claim 1 , wherein performing the service action comprises applying security policies based on a user location.
10 . The method of claim 1 , wherein the metadata comprises one or more of a client identifier, an access network identifier, an enterprise policy tag, a client device indoor location, an access point identifier, a Service Set Identifier (SSID), and a user role.
11 . A system comprising:
a memory storage; and
a processing unit coupled to the memory storage, wherein the processing unit is operative to:
send metadata from a wireless network to a Service Function (SF) selected from one of a plurality of SFs of a service chain, wherein the processing unit being operative to send the metadata comprises the processing unit being operative to:
steer data packets of a session to the SF for a predetermined interval, and
add a Network Service Header (NSH) comprising the metadata to the data packets;
receive a control trigger from the SF in response to the metadata; and
perform a service action on the wireless network in response to the control trigger.
12 . The system of claim 11 , wherein the processing unit being operative to perform the service action comprises the processing unit being operative to terminate the session when a malicious flow is detected.
13 . The system of claim 11 , wherein the processing unit being operative to perform the service action comprises the processing unit being operative to reserve specific scheduling resources on an air interface in the wireless network based on Deep Packet Inspection (DPI) and an application identifier.
14 . The system of claim 11 , wherein the processing unit being operative to perform the service action comprises the processing unit being operative to apply a service function insertion on a client session on the wireless network.
15 . The system of claim 11 , wherein the processing unit being operative to perform the service action comprises the processing unit being operative to link service chain events received over the NSH with signaling on the wireless network.
16 . A non-transitory computer-readable medium that stores a set of instructions which when executed perform a method executed by the set of instructions comprising:
sending, by a Wireless Local Area Network (LAN) Controller (WLC), metadata from a wireless network to a Service Function (SF) selected from one of a plurality of SFs of a service chain, wherein sending the metadata comprises:
steering data packets of a session to the SF for a predetermined interval, and
adding a Network Service Header (NSH) comprising the metadata to the data packets;
receiving, by the WLC, a control trigger from the SF in response to the metadata; and
performing, by WLC, a service action on the wireless network in response to the control trigger.
17 . The non-transitory computer-readable medium of claim 16 , wherein performing the service action comprises restricting user-access based on at least one of a client device location, a user role, and an application identifier.
18 . The non-transitory computer-readable medium of claim 16 , wherein performing the service action comprises quarantining of a client device for a certain time when an anomaly is detected.
19 . The non-transitory computer-readable medium of claim 16 , wherein performing the service action comprises permitting access to certain applications based on a user role.
20 . The non-transitory computer-readable medium of claim 16 , wherein performing the service action comprises applying security policies based on a user location.