Network access control for devices in a software defined access (SDA) fabric
A first address resolution request may be received by a first access switch from a first device and the address resolution request may be resolved by the first access switch with a central database of a network. Then a second address resolution request may be sent to a sensor by the first access switch in response to resolving the first address resolution request. An address resolution response may then be sent by the sensor to the first device in response to the sensor determining that the first device is a bad endpoint. A session may then be established between the sensor and the first device in response to the sensor sending the address resolution response. The first device may then be prompted by the sensor via the established session to resolve issues that lead the sensor to determine that the first device is a bad endpoint.
1. A method comprising:
receiving, by a first access switch from a first device, a first address resolution request;
resolving, by the first access switch with a central database of a network, the address resolution request; and
sending, by the first access switch in response to resolving the first address resolution request, a second address resolution request to a sensor, wherein sending the second address resolution request comprises converting, by the first access switch, the first address resolution request into the second address resolution request and a third address resolution request, wherein each of the second address resolution request and the third resolution request is a unicast message, and wherein converting the first address resolution request into the second address resolution request and the third address resolution request comprises converting the first address resolution request serially into the second address resolution request and the third address resolution request, and wherein converting the first address resolution request serially into the second address resolution request and the third address resolution request further comprises:
sending the second address resolution request to the sensor;
sending, by the sensor to the first device in response to the sensor determining that the first device is a bad endpoint, an address resolution response;
establishing a session between the sensor and the first device in response to the sensor sending the address resolution response;
prompting, by the sensor via the established session, the first device to resolve issues that lead the sensor to determine that the first device is a bad endpoint; and
sending the third address resolution request to a second device after the first device resolving the issues that lead the sensor to determine that the first device is a bad endpoint.
2. The method of claim 1 , wherein receiving the first address resolution request comprises receiving the first address resolution request wherein the first address resolution request is broadcast.
3. The method of claim 1 , wherein sending the second address resolution request to the sensor comprises sending the second address resolution request to the sensor comprising a Network Access Control (NAC) device.
4. The method of claim 1 , wherein the sensor determining that the first device is a bad endpoint comprises the sensor determining at least one of the following: that the first device does not have up-to-date software and that the first device is not secured.
5. The method of claim 1 , wherein sending by the sensor to the first device the address resolution response comprises sending by the sensor to the first device the address resolution response within a predetermined amount of time.
6. The method of claim 1 , wherein receiving the first address resolution request comprises receiving the first address resolution request comprising an Address Resolution Protocol (ARP) request.
7. A method comprising:
receiving, by a first access switch from a first device, a first address resolution request;
resolving, by the first access switch with a central database of a network, the address resolution request;
sending, by the first access switch in response to resolving the first address resolution request, a second address resolution request to a sensor;
sending, by the first access switch in response to one of the following: not receiving a response from the sensor in response to the second address resolution request within a predetermined amount of time and receiving a go-ahead response from the sensor in response to the second address resolution request, a third address resolution request to a second device, wherein sending the second address resolution request comprises converting, by the first access switch, the first address resolution request into the second address resolution request and the third address resolution request, wherein each of the second address resolution request and the third resolution request is a unicast message, wherein converting the first address resolution request into the second address resolution request and the third address resolution request comprises converting the first address resolution request serially into the second address resolution request and the third address resolution request, and wherein converting the first address resolution request serially into the second address resolution request and the third address resolution request comprises:
sending the second address resolution request to the sensor, and
sending the third address resolution request to the second device in response to one of the following: the predetermined amount of time and receiving the go-ahead response from the sensor in response to the second address resolution request;
sending, by the second device to the first device in response to the third address resolution request, an address resolution response to the first access switch; and
establishing a session between the first device and the second device in response to the second device sending the address resolution response to the first access switch.
8. The method of claim 7 , wherein receiving the first address resolution request comprises receiving the first address resolution request wherein the first address resolution request is broadcast.
9. The method of claim 7 , wherein sending the second address resolution request to the sensor comprises sending the second address resolution request to the sensor comprising a Network Access Control (NAC) device.
10. The method of claim 7 , wherein not receiving the response from the sensor to the second address resolution request within the predetermined amount of time comprises the sensor determining at least one of the following: that the first device has up-to-date software and that the first device is secured.
11. The method of claim 7 , wherein receiving the first address resolution request comprises receiving the first address resolution request comprising an Address Resolution Protocol (ARP) request.
12. A system comprising:
a first access switch comprising;
a first memory storage; and
a first processing unit coupled to the first memory storage, wherein the first processing unit is operative to:
receive, from a first device, a first address resolution request;
resolve, with a central database of a network, the first address resolution request; and
send, in response to resolving the first address resolution request, a second address resolution request to a sensor, wherein the first processing unit being operative to send the second address resolution request comprises the first processing unit being operative to convert the first address resolution request into the second address resolution request and a third address resolution request, wherein each of the second address resolution request and the third resolution request is a unicast message, wherein the first address resolution request is converted serially into the second address resolution request and the third address resolution request, and
send the second address resolution request to the sensor; and
the sensor comprising;
a second memory storage; and
a second processing unit coupled to the second memory storage, wherein the second processing unit is operative to:
send, to the first device in response to determining that the first device is a bad endpoint, an address resolution response;
establish a session between the sensor and the first device in response to the sensor sending the address resolution response; and
prompt, via the established session, the first device to resolve issues that lead the sensor to determine that the first device is a bad endpoint, wherein the first processing unit is further operative to send the third address resolution request to the second device in response to the first device resolving the issues that lead the sensor to determine that the first device is a bad endpoint.
13. The system of claim 12 , wherein the first address resolution request is broadcast.
14. The system of claim 12 , wherein to the sensor comprises a Network Access Control (NAC) device.
15. The system of claim 12 , wherein the second processing unit being operative to determine that the first device is a bad endpoint comprises the second processing unit being operative to determine at least one of the following: that the first device does not have up-to-date software and that the first device is not secured.
16. The system of claim 12 , wherein the second processing unit being operative to send to the first device the address resolution response comprises the second processing unit being operative to send to the first device the address resolution response within a predetermined amount of time.
17. The system of claim 12 , wherein the first address resolution request comprises an Address Resolution Protocol (ARP) request.
18. The method of claim 1 , further comprising:
storing the address resolution response at the first access switch.
19. The method of claim 1 , further comprising:
polling, by the first access switch, the sensor to determine address resolution responses for known devices.
20. The method of claim 1 , further comprising:
proactively providing by the sensor address resolution responses for known devices.