Method to allow seamless connectivity for wireless devices in DHCP snooping/dynamic ARP inspection/IP source guard enabled unified network
View Patent ↗Techniques disclosed herein include systems and methods for providing a mechanism to enable smooth, seamless, and reliable connectivity for wireless devices in a unified network, such as networks that apply a given security policy to both wired and wireless devices. The system supports roaming of mobile units across mobility switches. A given mobile unit can retain its IP address in both intra-subnet and inter-subnet roaming scenarios. The given mobile unit also retains its membership to a mobility VLAN to which the mobile unit had been assigned, even during roaming scenarios. The system moves or propagates IP address to MAC address bindings from one network to another network within a mobility domain. As soon as a mobile user roams to another network, authentication information is readily available to enable immediate connection to the new network to begin sending and receiving data traffic. The mobile unit can be using either static IP addressing, or can dynamically acquire IP addresses through DHCP.
1. A computer-implemented method comprising:
establishing a control channel between a first mobility switch and a second mobility switch within a mobility domain, the mobility domain providing wireless network connectivity for mobile units and wired network connectivity for static client devices, the control channel providing a connection for control messaging between the first mobility switch and the second mobility switch, the first mobility switch and the second mobility switch being network switches that process data traffic from one or more mobile units and from one or more static client devices, the first mobility switch providing connectivity for a first virtual local area network, the second mobility switch providing connectivity for a second virtual local area network;
executing a security policy that controls data traffic based at least on IP (Internet Protocol) addresses of client devices attempting to connect to the mobility domain, the security policy being executed for both the first virtual local area network and for the second virtual local area network, the security policy being applied equally to both static computing devices and to mobile units;
receiving an authentication request for a first mobile unit to connect to the mobility domain via the first mobility switch;
adding an access control list entry to a first binding table, the first binding table being associated with the first mobility switch, the first binding table maintaining an association of source IP address to Media Access Control (MAC) address of client devices, the access control list entry indicating that the first mobile unit is authenticated for transmitting data traffic within the mobility domain via the first mobility switch;
transmitting the access control list entry to a second binding table via the control channel, the second binding table being associated with the second mobility switch, the access control list entry in the second binding table indicating that the first mobile unit is authenticated for transmitting data traffic within the mobility domain via the second mobility switch;
establishing a first access tunnel between the first mobility switch and a first access point device, the first access point device having a network connection to the first mobility switch, the first access point device providing wireless network connectivity to one or more mobile units; and
establishing a second access tunnel between the second mobility switch and a second access point device, the second access point device having a network connection to the second mobility switch, the second access point device providing wireless network connectivity to one or more mobile units within the mobility domain.
2. The computer-implemented method of claim 1 , further comprising:
configuring an IP address to MAC binding in a remote authentication server for the first mobile unit, the remote authentication server being separate from the first mobility switch and the second mobility switch; and
wherein receiving the authentication request for the first mobile unit to connect to the mobility domain via the first mobility switch includes transmitting the authentication request from the first access point device to the remote authentication server in response to the first mobile unit attempting to connect to the mobility domain at the first access point device.
3. The computer-implemented method of claim 2 , further comprising:
receiving, from the remote authentication server, an authentication response at the first access point device, the authentication response including the IP address to MAC address binding for the first mobile unit;
building an IP address to MAC address binding table at the first access point device; and
transmitting IP address to MAC binding entries from the first access point device to the first mobility switch.
4. The computer-implemented method of claim 3 , further comprising:
wherein transmitting the access control list entry to the second binding table via the control channel includes transmitting the access control list entry to the second access point device;
receiving an authentication request, at the second access point device, for the first mobile unit to connect to the mobility domain via the second mobility switch; and
in response to receiving the authentication request at the second access point device, authenticating the first mobile unit at the second access point device without transmitting the authentication request to the remote authentication server.
5. The computer-implemented method of claim 3 , wherein executing the security policy that controls data traffic based at least on IP addresses includes executing at least IP Source Guard.
6. The computer-implemented method of claim 1 , wherein executing the security policy that controls data traffic based at least on IP addresses includes executing at least Dynamic Host Configuration Protocol (DHCP) snooping, IP Source Guard, and Dynamic Address Resolution Protocol Inspection.
7. The computer-implemented method of claim 6 , further comprising:
wherein receiving the authentication request for a first mobile unit to connect to the mobility domain via the first mobility switch includes receiving the authentication request at the first access point device;
in response to receiving the authentication request, inspecting DHCP packets at the first access point device to identify an IP address to MAC address binding for the first mobile unit; and
building an IP address to MAC address binding table at the first access Point device.
8. The computer-implemented method of claim 7 , further comprising:
wherein transmitting the access control list entry to the second binding table via the control channel includes transmitting the access control list entry, identified through DHCP snooping, to the second access point device;
receiving an authentication request, at the second access point device, for the first mobile unit to connect to the mobility domain via the second mobility switch; and
in response to receiving the authentication request at the second access point device, authenticating the first mobile unit at the second access point device without transmitting the authentication request to the remote authentication server.
9. A computer system comprising:
a memory;
a processor;
a communications interface;
an interconnection mechanism coupling the memory, the processor and the communications interface, the memory storing instructions that when executed by the processor cause the system to perform the operations of:
establishing a control channel between a first mobility switch and a second mobility switch within a mobility domain, the mobility domain providing wireless network connectivity for mobile units and wired network connectivity for static client devices, the control channel providing a connection for control messaging between the first mobility switch and the second mobility switch, the first mobility switch and the second mobility switch being network switches that process data traffic from one or more mobile units and from one or more static client devices, the first mobility switch providing connectivity for a first division of the mobility domain, the second mobility switch providing connectivity for a second division of the mobility domain;
executing a security policy that controls data traffic based at least on IP (Internet Protocol) addresses of client devices attempting to connect to the mobility domain, the security policy being executed for both the first division of the mobility domain and for the second division of the mobility domain, the security policy being applied equally to both static computing devices and to mobile units;
receiving an authentication request for a first mobile unit to connect to the mobility domain via the first mobility switch;
adding an access control list entry to a first binding table, the first binding table being associated with the first mobility switch, the first binding table maintaining an association of source IP address to Media Access Control (MAC) address of client devices, the access control list entry indicating that the first mobile unit is authenticated for transmitting data traffic within the mobility domain via the first mobility switch;
transmitting the access control list entry to a second binding table via the control channel, the second binding table being associated with the second mobility switch, the access control list entry in the second binding table indicating that the first mobile unit is authenticated for transmitting data traffic within the mobility domain via the second mobility switch;
establishing a first access tunnel between the first mobility switch and a first access point device, the first access point device having a network connection to the first mobility switch, the first access point device providing wireless network connectivity to one or more mobile units; and
establishing a second access tunnel between the second mobility switch and a second access point device, the second access point device having a network connection to the second mobility switch, the second access point device providing wireless network connectivity to one or more mobile units within the mobility domain.
10. The computer system of claim 9 , wherein the memory stores further instructions that when executed by the processor cause the system to perform the operations of:
configuring an IP address to MAC binding in a remote authentication server for the first mobile unit, the remote authentication server being separate from the first mobility switch and the second mobility switch; and
wherein receiving the authentication request for the first mobile unit to connect to the mobility domain via the first mobility switch includes transmitting the authentication request from the first access point device to the remote authentication server in response to the first mobile unit attempting to connect to the mobility domain at the first access point device.
11. The computer system of claim 10 , wherein the memory stores further instructions that when executed by the processor cause the system to perform the operations of:
receiving, from the remote authentication server, an authentication response at the first access point device, the authentication response including the IP address to MAC address binding for the first mobile unit;
building an IP address to MAC address binding table at the first access Point device; and
transmitting IP address to MAC binding entries from the first access point Device to the first mobility switch.
12. The computer system of claim 11 , wherein the memory stores further instructions that when executed by the processor cause the system to perform the operations of:
wherein transmitting the access control list entry to the second binding table via the control channel includes transmitting the access control list entry to the second access point device;
receiving an authentication request, at the second access point device, for the first mobile unit to connect to the mobility domain via the second mobility switch; and
in response to receiving the authentication request at the second access point device, authenticating the first mobile unit at the second access point device without transmitting the authentication request to the remote authentication server.
13. The computer system of claim 11 , wherein executing the security policy that controls data traffic based at least on IP addresses includes executing at least IP Source Guard.
14. The computer system of claim 9 , wherein executing the security policy that controls data traffic based at least on IP addresses includes executing at least Dynamic Host Configuration Protocol (DHCP) snooping, IP Source Guard, and Dynamic Address Resolution Protocol Inspection.
15. The computer system of claim 14 , wherein the memory stores Further instructions that when executed by the processor cause the system to Perform the operations of:
wherein receiving the authentication requested for a first mobile unit to connect to the mobility domain via the first mobility switch includes receiving the authentication requests at the first access point device;
in response to receiving the authentication request, inspecting DHCP packets at the first access point device to identify an IP address to MAC address binding for the first mobile unit; and
building an IP address to MAC address binding table at the first access point device.
16. The computer system of claim 15 , wherein the memory stores further instructions that when executed by the processor cause the system to perform the operations of:
wherein transmitting the access control list entry to the second binding table via the control channel includes transmitting the access control list entry, identified through DHCP snooping, to the second access point device;
receiving an authentication request, at the second access point device, for the first mobile unit to connect to the mobility domain via the second mobility switch; and
in response to receiving the authentication request at the second access point device, authenticating the first mobile unit at the second access point device without transmitting the authentication request to the remote authentication server.
17. A non-transitory computer-storage medium having instructions stored thereon for processing data information, such that the instructions, when carried out by a processing device, cause the processing device to perform the operations of:
establishing a control channel between a first mobility switch and a second mobility switch within a mobility domain, the mobility domain providing wireless network connectivity for mobile units and wired network connectivity for static client devices, the control channel providing a connection for control messaging between the first mobility switch and the second mobility switch, the first mobility switch and the second mobility switch being network switches that process data traffic from one or more mobile units and from one or more static client devices, the first mobility switch providing connectivity for a first virtual local area network, the second mobility switch providing connectivity for a second virtual local area network;
executing a security policy that controls data traffic based at least on IP (Internet Protocol) addresses of client devices attempting to connect to the mobility domain, the security policy being executed for both the first virtual local area network and for the second virtual local area network, the security policy being applied equally to both static computing devices and to mobile units;
receiving an authentication request for a first mobile unit to connect to the mobility domain via the first mobility switch;
adding an access control list entry to a first binding table, the first binding table being associated with the first mobility switch, the first binding table maintaining an association of source IP address to Media Access Control (MAC) address of client devices, the access control list entry indicating that the first mobile unit is authenticated for transmitting data traffic within the mobility domain via the first mobility switch;
transmitting the access control list entry to a second binding table via the control channel, the second binding table being associated with the second mobility switch, the access control list entry in the second binding table indicating that the first mobile unit is authenticated for transmitting data traffic within the mobility domain via the second mobility switch;
establishing a first access tunnel between the first mobility switch and a first access point device, the first access point device having a network connection to the first mobility switch, the first access point device providing wireless network connectivity to one or more mobile units;
establishing a second access tunnel between the second mobility switch and a second access point device, the second access point device having a network connection to the second mobility switch, the second access point device providing wireless network connectivity to one or more mobile units within the mobility domain; and
wherein executing the security policy that controls data traffic based at least on IP addresses includes executing at least Dynamic Host Configuration Protocol (DHCP) snooping, IP Source Guard, and Dynamic Address Resolution Protocol Inspection.