IP Library › Granted Patent US 12696170
Granted Patent B2
US 12696170 · App. 18/198,635 · Granted Jul 28, 2026

Traffic-based tunnel endpoint assignment for local area networks

Inventors: Jerome Henry (Pittsboro, NC); Robert Edgar Barton (Richmond, CA); Indermeet Gandhi (San Jose, CA)
Assignee: Cisco Technology, Inc.
H04W40/246
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12696170
App. No.
18/198,635
Granted
Jul 28, 2026
Kind
B2
Abstract

A network function orchestrator (NFO) of a local area network (LAN) controller can configure multiple different tunnel endpoints in the LAN based on network traffic observed within the LAN. The NFO can monitor network traffic communicated from client devices and through access points in the LAN. The network traffic can be associated with multiple different destinations. The NFO can determine, based on the network traffic and using network topology data, network devices to serve as tunnel endpoints within the LAN. Different tunnel endpoints can be configured for use in connection with different traffic destinations. The NFO can communicate with the network devices and the access points to configure the LAN to use the different tunnel endpoints.

Claims (67)

1 . A method, comprising:

monitoring network traffic communicated from client devices and through access points in a local area network, wherein the network traffic comprises multiple different destinations;

determining, based at least in part on the monitoring, the multiple different destinations;

receiving network topology data indicating a topology of network devices in the local area network;

determining, using the network topology data, a first network device within the local area network to serve as a first tunnel endpoint and a second network device within the local area network to serve as a second tunnel endpoint;

communicating with the first network device to configure the first network device to act as the first tunnel endpoint, wherein the first tunnel endpoint is adapted to:

receive first network traffic via first tunnels from the access points, wherein the first network traffic is of a first traffic type which is destined to a first destination of the multiple different destinations; and

forward the first network traffic to the first destination;

communicating with the second network device to configure the second network device to act as the second tunnel endpoint, wherein the second tunnel endpoint is adapted to:

receive second traffic via second tunnels from the access points, wherein the second network traffic is of a second traffic type which is destined to a second destination of the multiple different destinations; and

forward the second network traffic to the second destination;

providing the first network device with first policies to apply to the first network traffic received via the first tunnels; and

providing the second network device with second policies to apply to the second network traffic received via the second tunnels.

2 . The method of claim 1 , wherein the determining, using the network topology data, the first network device within the local area network to serve as the first tunnel endpoint and the second network device within the local area network to serve as the second tunnel endpoint is based at least in part on first and second network distances, respectively, wherein the first network distance comprises a network distance between the first network device and the first destination, and wherein the second network distance comprises a network distance between the second network device and the second destination.

3 . The method of claim 1 , further comprising:

determining the first policies to apply to the first network traffic, wherein the first policies comprise a first portion of network policies applicable to the network traffic, wherein the first portion of the network policies is applicable to the first destination; and

determining the second policies to apply to the second network traffic, wherein the second policies comprise a second portion of the network policies applicable to the network traffic, wherein the second portion of the network policies is applicable to the second destination.

4 . The method of claim 1 , wherein the first tunnels and the second tunnels comprise control and provisioning of wireless access points (CAPWAP) tunnels.

5 . The method of claim 1 , wherein the method is performed at a cloud location that is outside the local area network.

6 . The method of claim 1 , wherein;

the first destination is an authentication server, the first traffic type comprises authentication traffic, and the first tunnel endpoint is adapted to receive the first network traffic and forward the first network traffic to the authentication server; and

the second destination is a dynamic host control protocol (DHCP) server, the second traffic type comprises DHCP traffic, and the second tunnel endpoint is adapted to receive the second network traffic and forward the second network traffic to the DHCP server.

7 . The method of claim 1 , wherein:

the first destination is a dynamic host control protocol (DHCP) server, the first traffic type comprises DHCP traffic, and the first tunnel endpoint is adapted to receive the first network traffic and forward the first network traffic to the DHCP server; and

the second destination is a public internet destination, the second traffic type comprises public internet traffic, and the second tunnel endpoint is adapted to receive the second network traffic and forward the second network traffic to the public internet destination.

8 . The method of claim 1 , wherein the first destination is a private data center, wherein the first traffic type comprises private data center traffic, and wherein the first tunnel endpoint is adapted to receive the first network traffic and forward the first network traffic to the private data center.

9 . A system comprising:

one or more processors; and

one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

monitoring network traffic communicated from client devices and through access points in a local area network, wherein the network traffic comprises multiple different destinations;

determining, based at least in part on the monitoring, the multiple different destinations;

receiving network topology data indicating a topology of network devices in the local area network;

determining, using the network topology data, a first network device within the local area network to serve as a first tunnel endpoint and a second network device within the local area network to serve as a second tunnel endpoint;

communicating with the first network device to configure the first network device to act as the first tunnel endpoint, wherein the first tunnel endpoint is adapted to:

receive first network traffic via first tunnels from the access points, wherein the first network traffic is of a first traffic type which is destined to a first destination of the multiple different destinations; and

forward the first network traffic to the first destination;

communicating with the second network device to configure the second network device to act as the second tunnel endpoint, wherein the second tunnel endpoint is adapted to:

receive second traffic via second tunnels from the access points, wherein the second network traffic is of a second traffic type which is destined to a second destination of the multiple different destinations; and

forward the second network traffic to the second destination;

providing the first network device with first policies to apply to the first network traffic received via the first tunnels; and

providing the second network device with second policies to apply to the second network traffic received via the second tunnels.

10 . The system of claim 9 , wherein the determining, using the network topology data, the first network device within the local area network to serve as the first tunnel endpoint and the second network device within the local area network to serve as the second tunnel endpoint is based at least in part on first and second network distances, respectively, wherein the first network distance comprises a network distance between the first network device and the first destination, and wherein the second network distance comprises a network distance between the second network device and the second destination.

11 . The system of claim 9 , wherein the operations further comprise:

determining the first policies to apply to the first network traffic, wherein the first policies comprise a first portion of network policies applicable to the network traffic, wherein the first portion of the network policies is applicable to the first destination; and

determining the second policies to apply to the second network traffic, wherein the second policies comprise a second portion of the network policies applicable to the network traffic, wherein the second portion of the network policies is applicable to the second destination.

12 . The system of claim 9 , wherein the first tunnels and the second tunnels comprise control and provisioning of wireless access points (CAPWAP) tunnels.

13 . The system of claim 9 , wherein the system is located at a cloud location that is outside the local area network.

14 . The system of claim 9 , wherein the first destination is an authentication server, wherein the first network traffic type comprises authentication traffic, and wherein the first tunnel endpoint is adapted to receive the first network traffic and forward the first network traffic to the authentication server.

15 . The system of claim 9 , wherein the first destination is a dynamic host control protocol (DHCP) server, wherein the first network traffic type comprises DHCP traffic, and wherein the first tunnel endpoint is adapted to receive the first network traffic and forward the first network traffic to the DHCP server.

16 . The system of claim 9 , wherein the first destination is a local destination within the local area network, wherein the first traffic type comprises local network traffic, and wherein the first tunnel endpoint is adapted to receive the first network traffic and forward the first network traffic to the local destination.

17 . One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

monitoring network traffic communicated from client devices and through access points in a local area network, wherein the network traffic comprises multiple different destinations;

determining, based at least in part on the monitoring, the multiple different destinations;

receiving network topology data indicating a topology of network devices in the local area network;

determining, using the network topology data, a first network device within the local area network to serve as a first tunnel endpoint and a second network device within the local area network to serve as a second tunnel endpoint;

communicating with the first network device to configure the first network device to act as the first tunnel endpoint, wherein the first tunnel endpoint is adapted to:

receive first network traffic via first tunnels from the access points, wherein the first network traffic is of a first traffic type which is destined to a first destination of the multiple different destinations; and

forward the first network traffic to the first destination;

communicating with the second network device to configure the second network device to act as the second tunnel endpoint, wherein the second tunnel endpoint is adapted to:

receive second traffic via second tunnels from the access points, wherein the second network traffic is of a second traffic type which is destined to a second destination of the multiple different destinations; and

forward the second network traffic to the second destination;

providing the first network device with first policies to apply to the first network traffic received via the first tunnels; and

providing the second network device with second policies to apply to the second network traffic received via the second tunnels.

18 . The one or more non-transitory computer-readable media of claim 17 , wherein the determining, using the network topology data, the first network device within the local area network to serve as the first tunnel endpoint and the second network device within the local area network to serve as the second tunnel endpoint is based at least in part on first and second network distances, respectively, wherein the first network distance comprises a network distance between the first network device and the first destination, and wherein the second network distance comprises a network distance between the second network device and the second destination.

19 . The one or more non-transitory computer-readable media of claim 17 , wherein the operations further comprise:

determining the first policies to apply to the first network traffic, wherein the first policies comprise a first portion of network policies applicable to the network traffic, wherein the first portion of the network policies is applicable to the first destination.

20 . The one or more non-transitory computer-readable media of claim 17 , wherein the first tunnels and the second tunnels comprise control and provisioning of wireless access points (CAPWAP) tunnels.