Methods and apparatus for split policy enforcement in wireless networks
A wireless local area network system allows policy enforcement execution to be split between an access port and a centralized wireless controller. The policy may be of various types, including, but not limited to, a firewall policy, a QoS policy, a traffic shaping policy, and a bandwidth-management policy. On the AP, for all the traffic that is to be bridged or forwarded to specified ports, the policy table on the AP is checked. If it matches the policy table entry, then the specified action is taken. For all the traffic that gets forwarded to the controller by the AP, the match is checked with the policy table at the controller. If a match is detected, then the appropriate action specified by the policy is taken.
1. A wireless local area network of the type including a controller and at least one access point, wherein policy enforcement for the wireless local area network is performed in part by both the controller and in part the access point, and wherein policy enforcement is conducted in accordance with policies included in a first policy table that includes: an access control list associated with the wireless local area network; and a set of rules associated with the access control list.
2. The wireless local area network of claim 1 , wherein the controller includes the first policy table associated with the network, and the access point includes a second policy table associated with the network, and the first and second policy tables collectively include all policies required for the policy enforcement.
3. The wireless local area network of claim 2 , wherein the second policy table includes: an access control list associated with the wireless local area network; and a set of rules associated with the access control list.
4. The wireless local area network of claim 2 , wherein at least one of the first policy table and the second policy table include at least one quality-of-service rule.
5. The wireless local area network of claim 2 , wherein at least one of the first policy table and the second policy table include at least one bandwidth rule.
6. The wireless local area network of claim 1 , wherein, each policy has an associated enforcement point corresponding to either the access point or the controller.
7. The wireless local area network of claim 6 , wherein the enforcement point associated with each policy is configured by an algorithm.
8. The wireless local area network of claim 2 , wherein the second policy table is pushed to the access point by the controller.
9. A method of performing policy enforcement in a wireless local area network of the type including a controller and at least one access point, comprising the steps of:
determining an enforcement point of each of a set of policies associated with the network,
wherein the enforcement point is one of the controller and the access point;
providing, within the controller, a first policy table associated with policies having an enforcement point corresponding to the controller, wherein the first policy table includes: an access control list associated with the wireless local area network; and a set of rules associated with the access control list;
providing, within the access point, a second policy table associated with policies having an enforcement point corresponding to the access point;
receiving data traffic;
comparing the data traffic with at least one of the first set of policies and the second set of policies to determine a matched policy; and
taking an action, with respect to the data traffic, as specified by the matched policy.
10. The method of claim 9 , wherein the second policy table includes: an access control list associated with the wireless local area network; and a set of rules associated with the access control list.
11. The method of claim 9 , wherein at least one of the first policy table and the second policy table include at least one quality-of-service rule.
12. The method of claim 9 , wherein at least one of the first policy table and the second policy table include at least one bandwidth rule.
13. The method of claim 9 , further including the step of configuring the enforcement points based on an algorithm.
14. The method of claim 9 , wherein providing the second policy table includes pushing the second policy table to the access point from the controller.
15. An access point configured to store a policy table consisting of a proper subset of a set of policies associated with a wireless local area network for which the access point is adapted, wherein the policy table includes: an access control list associated with the wireless local area network; and a set of rules associated with the access control list.
16. The access point of claim 15 , further configured to receive the policy table over the network from a controller.