Multimode authentication
View Patent ↗Assigning clients to VLANs on a digital network. A client attaching to a digital network through a network device is initially assigned to a first VLAN. This VLAN may have restricted access and is used for authentication. The device snoops DHCP traffic on this first VLAN rewriting DHCP traffic from the client to request a short lease time for the client. A short lease time may be on the order of 30 seconds. The device optionally rewrites DHCP traffic to the client on the first VLAN to assure a short lease time is returned; this rewriting supports DHCP servers which do not issue short leases. Traffic on this first VLAN may be limited to authentication such as captive portals, 802.1x, Kerberos, and the like. If client authentication on the first VLAN does not succeed, when the short lease expires, the client will receive another short lease on the first VLAN. The network device snoops authentication traffic. When authentication succeeds, the device snoops this traffic and derives information such as roles and the target VLAN for the client, saving this information. When the short DHCP lease expires for the client, and the client restarts the DHCP process, the device assigns the client to the target VLAN and all further processing occurs on this target VLAN.
1. A system comprising:
at least one network device comprising a hardware processor;
the system being configured to perform operations comprising:
receiving, by the at least one network device from a client device, a Dynamic Host Configuration Protocol (DHCP) request;
rewriting, by the at least one network device, the DHCP request to include a particular lease time; and
subsequent to the rewriting operation: forwarding, by the at least one network device to a DHCP server, the DHCP request with the particular lease time.
2. The system of claim 1 , wherein the operations further comprise:
snooping DHCP traffic from the DHCP server;
rewriting a response to the DHCP request included in the DHCP traffic to the client to indicate the particular lease time.
3. The system of claim 1 , wherein the operations further comprise:
issuing a DHCP release for an address, on a virtual local area network (VLAN), associated with the client device.
4. A non-transitory machine readable medium having a set of instructions stored in nonvolatile form therein, which when executed on a network device, causes a set of operations to be performed, comprising:
receiving, by a network device from a client device, a Dynamic Host Configuration Protocol (DHCP) request;
rewriting, by the network device, the DHCP request to include a particular lease time; and subsequent to the rewriting operation: forwarding, by the network device to a DHCP server, the DHCP request with the particular lease time.
5. The non-transitory machine readable medium of claim 4 having a set of instructions stored in nonvolatile form therein, which when executed on the network device, causes further operations to be performed, comprising:
snooping DHCP traffic from the DHCP server;
rewriting a response to the DHCP request included in the DHCP traffic to the client to indicate the particular lease time.
6. The non-transitory machine readable medium of claim 4 having a set of instructions stored in nonvolatile form therein, which when executed on the network device, causes further operations to be performed, comprising issuing a DHCP release an address, on a virtual local area network (VLAN), associated with the client device.
7. The non-transitory machine readable medium of claim 4 , wherein rewriting the DHCP request comprises shortening the lease time included in the DHCP request to the particular lease time.
8. The non-transitory machine readable medium of claim 4 , wherein prior to rewriting the DHCP request, the DHCP request does not specify any lease time.
9. The non-transitory machine readable medium of claim 4 , wherein the DHCP request received from the client device specifies a first lease time, and wherein rewriting the DHCP request comprises modifying the first lease time to the particular lease time.
10. The non-transitory machine readable medium of claim 4 , wherein the DHCP server grants a DHCP lease based on the particular lease time.
11. The non-transitory machine readable medium of claim 4 , wherein the network device is a switch.
12. The system of claim 1 , wherein the operations further comprise: rewriting the DHCP request comprises shortening a lease time included in the DHCP request to the particular lease time.
13. The system of claim 1 , wherein the operations further comprise that, prior to rewriting the DHCP request, the DHCP request does not specify any lease time.
14. The system of claim 1 , wherein the DHCP request received from the client device specifies a first lease time, and wherein rewriting the DHCP request comprises modifying the first lease time to the particular lease time.
15. The system of claim 1 , wherein the DHCP server grants a DHCP lease based on the particular lease time.
16. A system comprising:
at least one network device comprising a hardware processor;
the system being configured to perform operations comprising:
receiving, by the at least one network device, a first Dynamic Host Configuration Protocol (DHCP) lease time from a DHCP server in a response to a DHCP request;
determining, by the at least one network device, if a client device is connected to a first VLAN;
responsive to the client device being connected to the first VLAN: modifying, by the at least one network device, the first DHCP lease time to a second DHCP lease time that is different than the first DHCP lease time;
subsequent to the modifying operation: forwarding, by the at least one network device, the response with the second DHCP lease time to a client device requesting a DHCP lease.
17. The system of claim 16 , wherein the second DHCP lease time is shorter than the first DHCP lease time.
18. The system of claim 16 , the operations further comprise:
switching the client device from a first virtual local area network (VLAN) to a second VLAN.
19. The system of claim 18 , the operations further comprise:
issuing a DHCP release for a client address, on the first VLAN, associated with the client device.
20. A non-transitory machine readable medium having a set of instructions stored in nonvolatile form therein, which when executed on a network device, causes a set of operations to be performed, comprising:
receiving, by a network device, a first Dynamic Host Configuration Protocol (DHCP) lease time from a DHCP server in a response to a DHCP request;
determining, by the network device, if a client device is connected to a first VLAN;
responsive to the client device being connected to the first VLAN: modifying, by the network device, the first DHCP lease time to a second DHCP lease time that is different than the first DHCP lease time;
subsequent to the modifying operation: forwarding, by the network device, the response with the second DHCP lease time to a client device requesting a DHCP lease.
21. The non-transitory machine readable medium of claim 20 , wherein the second DHCP lease time is shorter than the first DHCP lease time.
22. The non-transitory machine readable medium of claim 20 , further comprising switching the client device from a first virtual local area network (VLAN) to a second VLAN.
23. The non-transitory machine readable medium of claim 22 , further comprising issuing a DHCP release for a client address, on the first VLAN, associated with the client device.
24. The system of claim 2 , wherein the at least one network device performs the operations of receiving the DHCP request, rewriting the DHCP, and forwarding the DHCP request.
25. The system of claim 24 , wherein the at least one network device is a network switch that comprises the hardware processor, a memory and one or more input/output interfaces, the network switch is separate from and communicatively coupled to the client device and the DHCP server.
26. The non-transitory machine readable medium of claim 4 having the set of instructions executed on a processor of the network device being a network switch that (i) comprises the processor, a memory and one or more input/output interfaces and (ii) is separate from and communicatively coupled to the DHCP server and the client device.
27. The system of claim 16 , wherein the at least one network device performs the operations of receiving the first DHCP lease time, determining if the client device is connected to the first VLAN, modifying the first DHCP lease time, and forwarding the response.
28. The system of claim 27 , wherein the at least one network device is a network switch that (i) comprises the hardware processor, a memory and one or more input/output interfaces and (ii) is separate from and communicatively coupled to the client device and the DHCP server.
29. The non-transitory machine readable medium of claim 20 having the set of instructions executed on a processor of the network device being a network switch that (i) comprises the processor, a memory and one or more input/output interfaces and (ii) is separate from and communicatively coupled to the DHCP server and the client device.