Methods, apparatus and computer readable medium for conveying virtual local area network (VLAN) policies from designated to roamed network
View Patent ↗A method, apparatus and computer program product for providing policy inheritance between Virtual Local Area Networks (VLANs) is presented. The systems disclosed herein are able to convey, from a designated (i.e., first) VLAN to a roaming (i.e., second) VLAN, mobility VLAN policies enabled at the designated VLAN that are not provided at the roaming VLAN. In operation, example embodiments of the present invention detect a roaming mobile unit in the roaming VLAN. VLAN policies for the mobile unit are then requested from a VLAN server mobility switch in the designated VLAN. VLAN policies are then received and applied in the roaming VLAN.
1. A method for inheriting Virtual Local Area Network (VLAN) policies, the method comprising:
detecting a roaming mobile unit, roamed from a first VLAN, in a second VLAN;
requesting VLAN policies from a first mobility switch in the first VLAN over a mobility tunnel constructed to the first mobility switch in the first VLAN;
receiving the VLAN policies over the mobility tunnel from the first mobility switch in the first VLAN;
applying the VLAN policies from the first mobility switch in the first VLAN in the second VLAN;
in a plurality of mobility switches, for each mobility switch, constructing a mobility tunnel to each other mobility switch in the plurality of mobility switches such that each mobility switch is connected to each respective other mobility switch in form of a mesh network of mobility tunnels; and
in response to advertisements broadcast on the mesh network of mobility tunnels identifying mobility switches as VLAN servers for respective VLANs, recording each respective other mobility switch in the plurality of mobility switches as a potential VLAN server in its respective VLAN.
2. The method of claim 1 wherein detecting the roaming mobile unit in the second VLAN further comprises receiving a notification from an access point over an access tunnel constructed to the access point.
3. The method of claim 1 wherein applying the VLAN policies from the first mobility switch in the first VLAN in the second VLAN further comprises synchronizing VLAN policies for the roaming mobile unit across the first VLAN and the second VLAN.
4. The method of claim 3 wherein synchronizing VLAN policies for the roaming mobile unit across the first VLAN and the second VLAN further comprises providing increased network security.
5. The method of claim 1 further comprising receiving a report identifying the roaming mobile unit as a member of the first VLAN configured with VLAN policies by the first mobility switch acting as a VLAN server for the mobile unit in the first VLAN.
6. The method of claim 5 wherein receiving the report identifying the roaming mobile unit further comprises:
receiving the report from the first mobility switch acting as the VLAN server for the mobile unit in the first VLAN over the mobility tunnel constructed to the first mobility switch in the first VLAN;
examining the report to identify the first mobility switch as the VLAN server for the mobile unit in the first VLAN; and
updating a mobility VLAN database (MVDB) to include an entry identifying the first mobility switch as the VLAN server for the mobile unit in the first VLAN.
7. The method of claim 1 further comprising constructing an access tunnel between each mobility switch and access points connected to the mobility switch.
8. The method of claim 1 wherein the first VLAN and the second VLAN comprise a mobility domain and the first VLAN is not available at the second VLAN.
9. A computerized device for inheriting Virtual Local Area Network (VLAN) policies comprising:
a memory;
a processor;
a communications interface; and
an interconnection mechanism coupling the memory, the processor and the communications interface;
wherein the memory is encoded with a VLAN policy inheritance application that when executed in a process on the processor is capable of conveying VLAN policies by performing the operations of:
detecting a roaming mobile unit, roamed from a first VLAN, in a second VLAN;
requesting VLAN policies from a first mobility switch in the first VLAN over a mobility tunnel constructed to the first mobility switch in the first VLAN;
receiving the VLAN policies over the mobility tunnel from the first mobility switch in the first VLAN;
applying the VLAN policies from the first mobility switch in the first VLAN in the second VLAN;
in a plurality of mobility switches, for each mobility switch, constructing a mobility tunnel to each other mobility switch in the plurality of mobility switches such that each mobility switch is connected to each respective other mobility switch in form of a mesh network of mobility tunnels; and
in response to advertisements broadcast on the mesh network of mobility tunnels identifying mobility switches as VLAN servers for respective VLANs, recording each respective other mobility switch in the plurality of mobility switches as a potential VLAN server in its respective VLAN.
10. The computerized device of claim 9 wherein the operation of detecting the roaming mobile unit in the second VLAN further comprises the operation of receiving a notification from an access point over an access tunnel constructed to the access point.
11. The computerized device of claim 9 wherein the operation of applying the VLAN policies from the first mobility switch in the first VLAN in the second VLAN further comprises the operation of synchronizing VLAN policies for the roaming mobile unit across the first VLAN and the second VLAN.
12. The computerized device of claim 11 wherein the operation of synchronizing VLAN policies for the roaming mobile unit across the first VLAN and the second VLAN provides increased network security.
13. The computerized device of claim 9 further comprising the operation of receiving a report identifying the roaming mobile unit as a member of the first VLAN configured with VLAN policies by the first mobility switch acting as a VLAN server for the mobile unit in the first VLAN.
14. The computerized device of claim 13 wherein the operation of receiving the report identifying the roaming mobile unit further comprises the operations of:
receiving the report from the first mobility switch acting as the VLAN server for the mobile unit in the first VLAN over the mobility tunnel constructed to the first mobility switch in the first VLAN;
examining the report to identify the first mobility switch as the VLAN server for the mobile unit in the first VLAN; and
updating a mobility VLAN database (MVDB) to include an entry identifying the first mobility switch as the VLAN server for the mobile unit in the first VLAN.
15. The computerized device of claim 9 further comprising the operation of constructing an access tunnel between each mobility switch and access points connected to the mobility switch.
16. The computerized device of claim 9 wherein the first VLAN and the second VLAN comprise a mobility domain and the first VLAN is not available at the second VLAN.
17. A non-transitory computer readable medium encoded with computer readable code that when executed on a processor in a computerized device provides Virtual Local Area Network (VLAN) policy inheritance, the medium comprising:
instructions for detecting a roaming mobile unit, roamed from a first VLAN, in a second VLAN;
instructions for requesting VLAN policies from a first mobility switch in the first VLAN over a mobility tunnel constructed to the first mobility switch in the first VLAN;
instructions for receiving the VLAN policies over the mobility tunnel from the first mobility switch in the first VLAN;
instructions for applying the VLAN policies from the first mobility switch in the first VLAN in the second VLAN;
in a plurality of mobility switches, for each mobility switch, constructing a mobility tunnel to each other mobility switch in the plurality of mobility switches such that each mobility switch is connected to each respective other mobility switch in form of a mesh network of mobility,” runnels; and identifying mobility switches as VLAN servers for respective VLANs, recording each server in its respective VLAN.