Systems and methods for generating contextual labels
In one embodiment, an apparatus includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors. The one or more computer-readable non-transitory storage media include instructions that, when executed by the one or more processors, cause the apparatus to perform operations including receiving a user credential from a remote access client within a network and communicating the user credential to an authentication, authorization and accounting (AAA) server within the network. The operations also include receiving a user attribute from the AAA server and generating a contextual label based on the user attribute. The contextual label includes routing instructions associated with traffic behavior within the network. The operations further include advertising a control message, which includes the contextual label, to the remote access client.
1. An apparatus, comprising:
one or more processors; and
one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause the apparatus to perform operations comprising:
receiving a user credential from a remote access client over a network;
communicating the user credential to an authentication server;
receiving a user attribute from the authentication server;
generating one or more contextual instructions based on the user attribute and one or more application traffic policies, wherein:
the one or more contextual instructions comprises routing instructions; and
the routing instructions map one or more applications to a Virtual Private Network (VPN) routing/forwarding (VRF) instance; and
transmitting a message to the remote access client, wherein:
the message includes the one or more contextual instructions;
the one or more contextual instructions comprise a contextual label;
the remote access client uses the one or more contextual instructions to forward data packets associated with the one or more applications to the VPN VRF instance; and
the remote access client adds the contextual label to the data packets.
2. The apparatus of claim 1 , wherein the user attribute corresponds to a user group.
3. The apparatus of claim 1 , wherein the user attribute corresponds to a security group.
4. The apparatus of claim 1 , wherein the user attribute is associated with one or more of the following:
a security group;
a quality of service (QOS) profile; or
a Network Address Translation (NAT) profile.
5. The apparatus of claim 1 , wherein the user credential comprises a username and a password.
6. The apparatus of claim 1 , wherein the user credential identifies a user associated with the remote access client.
7. The apparatus of claim 1 , wherein the operations further comprise establishing a secure session with the remote access client.
8. The apparatus of claim 7 , wherein the secure session is a Secure Sockets Layer (SSL) connection.
9. The apparatus of claim 1 , wherein the operations further comprise:
determining that the user attribute has changed; and
withdrawing the one or more contextual instructions in response to determining that the user attribute has changed.
10. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
receiving a user credential from a remote access client over a network;
communicating the user credential to an authentication server;
receiving a user attribute from the authentication server;
generating one or more contextual instructions based on the user attribute and one or more application traffic policies, wherein:
the one or more contextual instructions comprises routing instructions; and
the routing instructions map one or more applications to a Virtual Private Network (VPN) routing/forwarding (VRF) instance; and
transmitting a message to the remote access client, wherein:
the message includes the one or more contextual instructions;
the one or more contextual instructions comprise a contextual label;
the remote access client uses the one or more contextual instructions to forward data packets associated with the one or more applications to the VPN VRF instance; and
the remote access client adds the contextual label to the data packets.
11. The one or more computer-readable non-transitory storage media of claim 10 , wherein the user attribute corresponds to a user group.
12. The one or more computer-readable non-transitory storage media of claim 10 , wherein the user attribute corresponds to a security group.
13. The one or more computer-readable non-transitory storage media of claim 10 , wherein the user attribute is associated with one or more of the following:
a security group;
a quality of service (QOS) profile; or
a Network Address Translation (NAT) profile.
14. The one or more computer-readable non-transitory storage media of claim 10 , wherein the user credential comprises a username and a password.
15. The one or more computer-readable non-transitory storage media of claim 10 , wherein the user credential identifies a user associated with the remote access client.
16. The one or more computer-readable non-transitory storage media of claim 10 , wherein the operations further comprise establishing a secure session with the remote access client.
17. The one or more computer-readable non-transitory storage media of claim 16 , wherein the secure session is a Secure Sockets Layer (SSL) connection.
18. The one or more computer-readable non-transitory storage media of claim 10 , wherein the operations further comprise:
determining that the user attribute has changed; and
withdrawing the one or more contextual instructions in response to determining that the user attribute has changed.
19. A method, comprising:
receiving, at an apparatus, a user credential from a remote access client over a network;
communicating the user credential to an authentication server;
receiving a user attribute from the authentication server;
generating one or more contextual instructions based on the user attribute and one or more application traffic policies, wherein:
the one or more contextual instructions comprises routing instructions; and
the routing instructions map one or more applications to a Virtual Private Network (VPN) routing/forwarding (VRF) instance; and
transmitting a message to the remote access client, wherein:
the message includes the one or more contextual instructions;
the one or more contextual instructions comprise a contextual label;
the remote access client uses the one or more contextual instructions to forward data packets associated with the one or more applications to the VPN VRF instance; and
the remote access client adds the contextual label to the data packets.
20. The method of claim 19 , wherein the user attribute corresponds to a user group.
21. The method of claim 19 , wherein the user attribute corresponds to a security group.
22. The method of claim 19 , wherein the user credential comprises a username and a password.
23. The method of claim 19 , wherein the user credential identifies a user associated with the remote access client.
24. The method of claim 19 , wherein the method further comprises establishing a secure session with the remote access client.
25. The method of claim 24 , wherein the secure session is a Secure Sockets Layer (SSL) connection.