Dynamically associating mobile devices with different logical networks implemented on a shared network fabric of a single entity
Some embodiments provide a novel method for dynamically associating mobile devices with different logical networks implemented on an entity's shared network fabric. At least two logical networks are implemented for at least two entity groups. At a first site, the method authenticates a mobile device and uses mobile device management (MDM) servers to identify an MDM group associated with the mobile device. The method uses the MDM group (1) to identify a first logical network over a shared network fabric at the first site to connect the mobile device to resources of the first site, and (2) to identify a logical network identifier (LNI) of a second logical network connecting a first edge gateway at the first site to a second edge gateway at a second site. The method inserts the LNI in an encapsulation header of data messages sent from the mobile device to resources at the second site.
1 . A method for dynamically associating mobile devices with different logical networks implemented on a shared network fabric of an entity, wherein at least two different logical networks are implemented for at least two different groups of the entity, the method comprising:
at a first site of the entity:
authenticating a particular mobile device;
using one or more mobile device management (MDM) servers to identify an MDM group with which the particular mobile device is associated, wherein using the one or more MDM servers to identify the MDM group comprises providing a media access control (MAC) address of the particular mobile device to the one or more MDM servers to identify a device group to which the particular mobile device belongs;
using the identified MDM group to identify a first logical network that is defined over the shared network fabric at the first site for the particular mobile device to connect to network resources of the first site that are connected to the first logical network;
using the identified MDM group to identify a logical network identifier (LNI) associated with a second logical network connecting a first edge gateway at the first site to a second edge gateway at a second site of the entity; and
inserting the LNI in an encapsulation header that encapsulates data messages sent from the particular mobile device to one or more network resources at the second site.
2 . The method of claim 1 , wherein the encapsulation header is a tunnel encapsulation header that is used to send the data messages from the first edge gateway to the second edge gateway through a tunnel established between the first and second edge gateways.
3 . The method of claim 1 , wherein the first logical network has an associated LNI and the first logical network LNI is the same as the second logical network LNI, as the first and second logical networks are one network.
4 . The method of claim 1 , wherein the first logical network has an associated LNI and the first logical network LNI is different than the second logical network LNI, as the first and second logical networks are two different logical networks with the first logical network being a logical local area network (LAN) and the second logical network being a logical wide area network (WAN).
5 . The method of claim 4 , wherein the encapsulation header is a first encapsulation header and the data messages are a first set of data messages, the method further comprising inserting the first logical network LNI in a second encapsulation header that encapsulates a second set of data messages sent from the particular mobile device to the network resources of the first site.
6 . The method of claim 4 , wherein using the one or more MDM servers to identify the MDM group further comprises receiving an MDM group identifier (ID) for the MDM group from the one or more MDM servers.
7 . The method of claim 6 , wherein:
using the identified MDM group to identify the first logical network comprises determining that the MDM group ID is associated with the first logical network LNI, and
using the identified MDM group to identify the second logical network LNI associated with the second logical network comprises determining that the MDM group ID is associated with the second logical network LNI.
8 . The method of claim 1 , wherein authenticating the particular mobile device comprises:
receiving a set of authentication credentials from the particular mobile device; and
using the set of authentication credentials to authenticate the particular mobile device.
9 . The method of claim 8 , wherein the set of authentication credentials comprises a username and password of a user of the particular mobile device.
10 . The method of claim 8 , wherein authenticating the particular mobile device comprises directing an authentication server operating at the first site to authenticate the particular mobile device.
11 . The method of claim 8 , wherein authenticating the particular mobile device comprises providing the set of authentication credentials to an authentication server operating at the second site to authenticate the particular mobile device.
12 . The method of claim 1 , wherein the network resources of the first site and the one or more network resources at the second site each comprise one or more of servers, applications, middlebox services, and forwarding elements.
13 . The method of claim 1 , wherein the at least two different groups of the entity comprise different user groups of the entity.
14 . The method of claim 1 , wherein the at least two different groups of the entity comprise different device groups of the entity.
15 . The method of claim 1 , wherein the device group comprises devices of a same type.
16 . The method of claim 15 , wherein the same type is one of a laptop, smartphone, or tablet.
17 . The method of claim 1 , wherein using the one or more MDM servers to identify the MDM group further comprises providing a set of authentication credentials associated with a user of the particular mobile device to the one or more MDM servers to identify a user group to which the user belongs.
18 . The method of claim 1 , wherein the first site is a branch site of the entity and the second site is a cloud site of the entity.
19 . A non-transitory machine readable medium storing a program for execution by at least one processing unit for dynamically associating mobile devices with different logical networks implemented on a shared network fabric of an entity, wherein at least two different logical networks are implemented for at least two different groups of the entity, the program comprising sets of instructions for:
at a first site of the entity:
authenticating a particular mobile device;
using one or more mobile device management (MDM) servers to identify an MDM group with which the particular mobile device is associated, using the one or more MDM servers to identify the MDM group comprising providing a media access control (MAC) address of the particular mobile device to the one or more MDM servers to identify a device group to which the particular mobile device belongs;
using the identified MDM group to identify a first logical network that is defined over the shared network fabric at the first site for the particular mobile device to connect to network resources of the first site that are connected to the first logical network;
using the identified MDM group to identify a logical network identifier (LNI) associated with a second logical network connecting a first edge gateway at the first site to a second edge gateway at a second site of the entity; and
inserting the LNI in an encapsulation header that encapsulates data messages sent from the particular mobile device to one or more network resources at the second site.
20 . The non-transitory machine readable medium of claim 19 , wherein the encapsulation header is a tunnel encapsulation header that is used to send the data messages from the first edge gateway to the second edge gateway through a tunnel established between the first and second edge gateways.