Cisco Technology, Inc.

Hewlett-packard Development Company, L.P.

Aruba Networks, Inc.

Bhanu Gopalasetty

Navindra Yadav

Sudhir Kumar Jain

Rohit Kumar Suri

Abhijit Kumar Choudhury

Patrice R Calhoun

Fusun Ertemalp

Kent Kinchu Leung

Sheausong Yang

Ramsundar Janakiraman

Gnanaprakasam Pandian

Chia Alex Tsai

Senthil Arunachalam

Ajit Sanzgiri

Hiroshi Suzuki

Sathish Damodaran

Ravinder Verma

Ly Loi

Bhawani Sapkota

Dong H Nguyen

Ranganatha Marathe

Vipul Shah

Sreenivasulu Mondem

Jun Xie

Xinhua Zhao

Aidan P Doyle

In one embodiment, a method includes receiving a packet at a network device in communication with a plurality of client nodes, the packet identifying a first client node, performing a look up in a table stored at the network device to locate policies associated with the first client node, the table including an entry for each of the client nodes, each entry having a plurality of policies associated with the client node, applying the policies associated with the first client node at a forwarding engine at the network device, and forwarding the packet from the network device. An apparatus is also disclosed.

Client modeling in a forwarding plane

A method includes selecting upstream and downstream aggregated MAC service data unit (AMSDU) sizes for communications between a client device, an access point, and an controller in a network system. The upstream and downstream AMSDU sizes may be separately selected based on the maximum transmission unit (MTU) size for communications in a secure tunnel between the controller and the access point to avoid fragmentation and reassembly of AMSDUs transmitted in a single MTU. The upstream and downstream AMSDU sizes may be selected to be less or equal to the MTU size.

Method and apparatus to control TX/RX AMSDU size based on the negotiated maximum transmission unit in the tunnel between a controller and an access point

The aggregation of packets in a network controller is described. A packet, destined to a station, is received at a network device having a plurality of processors. The packet is queued into a selected queue of a plurality of queues based at least on an identifier of the station and a category associated with the packet. The packet is aggregated with other packets in a selected queue to create an aggregated packet if the selected queue has reached a predetermined size, and the aggregated packet is transmitted to the destination station.

Method and apparatus for packet aggregation in a network controller

A first data set is derived from a second data set. The first data set is stored in a database of derived data sets. The second data set is updated without updating the first data set, such that the first data set and the second data are inconsistent. The first data set is deleted or updated during batch processing of the database of the derived data sets.

Method and system for maintaining derived data sets

In one embodiment, a method includes receiving a packet from a source wireless device at a second switch, the source wireless device previously associated with a first switch and roamed to and associated with the second switch, wherein a point of presence for the source wireless device is maintained at the first switch, inserting into the packet a direction indicator, and forwarding the packet from the second switch to the first switch, the direction indicator identifying the packet as being transmitted towards the point of presence for the source wireless device to prevent a forwarding loop. An apparatus is also disclosed.

Maintaining point of presence for clients roaming within a layer 2 domain

Techniques are provided to enable a support for guest access of devices in a network. At a controller apparatus in a first mobility sub-domain of a network comprising a plurality of mobility sub-domains, a request message containing a request for guest network access for a device is received from a first access switch in the first mobility sub-domain. The controller apparatus forwards the request message to a guest controller. At a tunneling endpoint apparatus in the first mobility sub-domain, a tunnel is established to the guest controller to carry traffic between the device and the guest controller. Traffic for the device passes in a tunnel between the first access switch and the tunneling endpoint apparatus in the first mobility sub-domain, through the tunneling endpoint apparatus in the first mobility sub-domain and in the tunnel between the routing apparatus in the first mobility sub-domain and the guest controller.

Guest access support for wired and wireless clients in distributed wireless controller system

A method and apparatus for handoff of a wireless client from a first network device to a second network device in a wired network are disclosed. In one embodiment, the method includes receiving data from a new wireless client at the second network device and transmitting a request for a route update for the new wireless client to the wired network. Prior to network convergence for the route update, data traffic for the new wireless client is received from the first network device and forwarded to the new wireless client. Context information for the new wireless client is transmitted from the second network device to other network devices in a proximity group of the second network device.

Fast handoff for wireless devices in a wired-wireless network

Techniques are provided for seamless integration of wired and wireless functionality packet forwarding in network. A plurality of access switches are provided in each of a plurality of mobility sub-domains that are part of a mobility domain of a network. Each access switch serves one or more Internet Protocol (IP) subnets, each comprising a plurality of IP addresses. An access switch obtains an IP address for a wireless device according to the one or more IP subnets that the access switch serves. The access switch sends an association advertisement message to indicate the IP address of the wireless device and to enable other access switches and routers to compute a path to the wireless device. When a wireless device obtains an IP address, it can keep the same IP address as it roams in the mobility domain.

Routing to the access layer to support mobility of internet protocol devices

Techniques are provided to enable support of roaming wireless devices in a network such that the wireless devices can keep their Internet Protocol (IP) addresses as they roam across mobility sub-domains. Traffic for a wireless device that roams is tunneled back to the access switch that serves the IP subnet which includes an IP address for the wireless device. Traffic is tunneled back to that access switch for the wireless device when the wireless device roams to another access switch which does not serve the IP subnet for the wireless device in the same mobility sub-domain and when the wireless device roams to a different mobility sub-domain, in which case the traffic is tunneled between tunneling endpoints in the respective mobility sub-domains.

Maintaining point of presence at access switch for roaming clients in distributed wireless controller system

Techniques are provided to support roaming of wireless devices in a network such that the wireless devices can keep their Internet Protocol (IP) addresses as they roam within and across mobility sub-domains. When a wireless device roams from one access switch to another access switch, a tunneling endpoint apparatus in the wireless device's home mobility sub-domain is configured to serve as the point of presence for the roamed wireless device. Traffic for the roamed wireless device is tunneled from the access switch where the wireless device has roamed (where it is currently attached) to the tunneling endpoint apparatus. When the wireless device roams across mobility sub-domains, then traffic is tunneled from the access switch where the wireless device is currently attached to the tunneling endpoint apparatus in that mobility sub-domain (called a 'foreign' mobility sub-domain) to the tunneling endpoint apparatus in the wireless device's home mobility sub-domain.

Maintaining point of presence at tunneling endpoint for roaming clients in distributed wireless controller system

A system and method for a hierarchical distributed control architecture to support roaming wireless client devices. Access switches serve one or more Internet Protocol (IP) subnets that include plural IP addresses. The access switches are arranged in switch peer groups and store information about other access switches in that switch peer group and about locations of wireless client devices that are associated with any access switch in the switch peer group. The access switches are further grouped into a corresponding mobility sub-domain each including plural switch peer groups. Plural controller devices control access switches in a corresponding mobility sub-domain. Each controller device stores information about the access switches and about locations of wireless client devices within its mobility sub-domain. A central controller device communicates with the controller devices for the respective mobility sub-domains. The central controller device stores information about locations of wireless client devices in the mobility sub-domains.

Hierarchical control signaling for mobile clients in distributed wireless controller system

In one embodiment, a method for processing encrypted wireless station data at a network device includes receiving from an access point, one or more frames comprising wireless station data fragmented into a plurality of encrypted protocol data units. The frames are configured to identify the encrypted protocol units associated with the wireless station data. The method further includes decrypting the encrypted protocol data units and forwarding the wireless station data. An apparatus for processing encrypted wireless station data, a method for transmitting encrypted multicast data for a wireless client, and a method for processing encrypted wireless station data at an access point are also disclosed.

Efficient data path encapsulation between access point and access switch

In one embodiment, detecting a wireless network access request, forwarding data associated with the detected wireless network access request to a first multipoint Generic Routing Encapsulation (mGRE) tunnel, receiving authentication information associated with the detected wireless network access request, receiving authentication status information for the detected wireless network access request, and forwarding data associated with the detected wireless network access request to a second multipoint Generic Routing Encapsulation (mGRE) tunnel connected to a predetermined internet protocol (IP) subnet when the received authentication status information includes a successful authentication, are provided.

Enterprise wireless local area network (LAN) guest access

Method and system for providing continuous data forwarding during a failure mode in a wireless data network including detecting a control plane failure mode of a network switch, maintaining data path between one or more network entities with the network switch, detecting the network switch recovery from the control plane failure mode, and re-authenticating the one or more network entities over the data network is disclosed without disrupting data traffic forwarding.

Growing community of inventors

San Jose, CA, United States of America

Bhanu Gopalasetty