Cisco Technology, Inc.

Charles Troper Yager

Aravind Sitaraman

Craig Michael Alesso

Purnam Anil Sheth

Gregory D Burns

Shujin Zhang

Surendra Anubolu

James William Edwards, Iii

Craig Zimmerman

Amar Chand Amar

Bradley D Erickson

Sandeep Arvind Patel

Paul Norwood Booth

Gurinderjit Chahal

George Manuelian

Vince Mammoliti

Kumar Reddy

Megan Minghua Bao

Ramesh R

A fault-tolerant stack of low cost switches each having only two dual-purpose uplinks is enabled by utilizing a specified topology for connecting the uplinks and implementing a recovery algorithm on each switch.

Dual-purpose uplinks used in a fault-tolerant stack

New virtual circuits (VCs) may be configured by a router as they are brought up, eliminating any need for preconfiguration. Specific ports may be set up to autoconfigure (and certain ports may be excluded for security or other reasons). When a packet from an unconfigured VC arrives, the router may then determine if the source VC it is a valid VC, such as whether it is in a valid range and unique to the interface. The Operating System may then send a message configuring the VC once it has been determine it is valid. The configuration used may be one that is part of a standard template. The next time a packet comes in from the VC, it may then be handled in accordance with the template.

Virtual circuit automatic configuration

In a first aspect of the present invention, a Wholesaler dynamically identifies one of a plurality of AAA services at a remote domain to route an access request to. The AAA service is selected based upon a set of rules applied to information which has been received dynamically from the plurality of AAA services and is indicative of load and status of the plurality of AAA services. In a second aspect of the present invention, a Wholesaler, based upon a Service Level Agreement (SLA) between the Wholesaler and a user, routes the user to one of a plurality of sub-service providers.

Proxy on demand

An address is allocated to a host device which is selected to obtain network access from any access point within a given communications system, while maintaining a settings configuration scheme that is consistently applied to the communications network for the user regardless of the access point used by the user. This is accomplished by assigning a user profile to a subscriber, said user profile including a pool identifier, said pool identifier indicating the settings configuration scheme for the subscriber; using said pool identifier to append one or more attributes to an authentication protocol packet, according to information contained in a first data structure; forwarding said authentication protocol packet to a Network Authentication Server; comparing said one or more attributes to a second data structure, said second data structure indicating the settings configuration scheme associated with said one or more attributes; and configuring settings on the communications network in accordance with the settings configuration scheme.

Support IP pool-based configuration

Determining the domain name associated with a virtual circuit may includes receiving, at an Authentication, Authorization, and Accounting (AAA) server, a Point-to-Point Protocol (PPP) authentication request comprising a unique identifier comprising a virtual channel ID, and determining whether a domain configuration override attribute exists in a virtual circuit profile associated with a DSLAM port used to receive the PPP authentication request. Determining the domain name further includes, if the domain configuration override attribute exists in the virtual circuit profile or if the PPP authentication request does not comprise a domain name, returning a domain name associated with the unique identifier, and if the domain configuration override attribute does not exist in the virtual circuit profile, returning a PPP domain name used in the PPP authentication request.

PPP domain name and L2TP tunnel selection configuration override

An Interchangeable Standard Port or Stack Port (ISPSP) uses a standard physical connector such as an RJ-45 or SFP. The ISPSP automatically detects whether it is connected to a standard port, such as a 1000BaseT, or whether it is connected to another ISPSP stacking port. This automatic detection can be done through hardware or software. Once the auto-detection is complete the routing platform will automatically configure the ISPSP port for standard 1 Gbps bit rate and framing, or for stacking, e.g., 2.5 Gbps bit rate, and framing.

Interchangeable standard port or stack port

A data communications network with a plurality of PoPs maintains a local database associated with each PoP and a central database somewhere on the data communications network. The local database contains a group identification such as a domain identification corresponding to a group of users, a maximum number of VPN sessions to provide the group of users at the PoP and a dynamic VPN session count corresponding to active VPN sessions currently provided to the group of users at the PoP. The central database contains a maximum number of VPN sessions to provide the group of users over the entire data communications network and a dynamic network-wide VPN session count corresponding to active VPN sessions currently provided to the group of users on the entire data communications network. Actions are taken when the group attempts to exceed either the local maximum number of sessions or the network-wide maximum number of sessions by more than a predetermined number. The actions may include assessing extra charges, denying access, and sending warning messages to appropriate recipients.

Virtual private data network session count limitation

A method for controlling subscriber access in a network capable of establishing connections with a plurality of domains includes receiving a communication from a subscriber using a first communication network coupled to at least one other communication network, the communication optionally including a domain identifier associated with a domain on the at least one other communication network, determining whether the subscriber is authorized to access the domain based upon the domain identifier and a list of authorized domains for a virtual circuit used to receive the communication and authorizing subscriber access to the domain when the domain identifier is included in the list. An access server includes a tunnel ID request generator and an authorizer. The tunnel ID request generator generates a tunnel ID request that includes a virtual circuit identifier associated with a virtual circuit used to accept a PPP authentication request. The authorizer grants subscribers domain access based upon a list of authorized domains for the virtual circuit.

Method and system for controlling subscriber access in a network capable of establishing connections with a plurality of domain sites

A method and apparatus for directing data network communications based on the geographic location of the user. One or the other or both of the geographic location of the local telephone access number with which the user is connected to one of a plurality of points of presence (PoPs) and the telephone number that the user is calling from to connect to the PoP is determined. This geographic location is compared to the geographic location of the home of the user. If the geographic locations differ, then it is determined that the user is a roaming user. If the user is a roaming user, then communications to the user over the data communications network are directed based at least in part upon the geographic location of the user.

Directing data network communications based on geographic location of a user

A system provides computer network access to PPP clients. The system includes (a) receiving a PPP session creation request from a client, the PPP session creation request including a control protocol frame encapsulated therein, (b) obtaining user domain information associated with the PPP session creation request, (c) setting up a Layer 2 tunnel according to a parameter contained in the control protocol frame, (d) creating an ingress PPP object associated with an incoming PPP session, a host object associated with the client, and an egress PPP object associated with the Layer 2 tunnel, (e) creating an egress IP object based upon obtained user domain information, the egress IP object associated with IP-based forwarding, (f) linking the ingress PPP object, the host object, and the egress PPP object, thereby forwarding data packets from a PPP session with the client over the Layer 2 tunnel, and (g) linking the host object and the egress IP object, thereby forwarding IP frames received from the client over a link other than the Layer 2 tunnel.

Method and system for providing network access to PPP clients

A method for controlling subscriber access in a network capable of establishing connections with multiple services includes receiving a communication from a subscriber using a first communication network coupled to a second communication network, the communication optionally including a domain identifier associated with a service on the second communication network, and authorizing the subscriber to access a service on the second communication network using a virtual circuit. The authorization is based upon a domain configuration override attribute associated with the virtual circuit used to receive the communication from the subscriber. An access server capable of forcing subscribers of a communications system to gain access exclusively to a domain network associated with a virtual circuit includes an authorizer to grant service authorization to the subscribers based upon a virtual circuit used to make a service request, a virtual circuit profile request generator to generate virtual circuit profile requests and a calculator to determine whether the service associated with the virtual circuit matches the service associated with a domain configuration override attribute.

A data communications network with a plurality of PoPs maintains a local database associated with each PoP and a central database somewhere on the data communications network. The local database contains a group identification such as a domain identification corresponding to a group of users, a maximum number of proxied sessions to provide the group of users at the PoP and a dynamic proxy session count corresponding to active proxied sessions currently provided to the group of users at the PoP. The central database contains a maximum number of proxied sessions to provide the group of users over the entire data communications network and a dynamic network-wide proxy session count corresponding to active proxied sessions currently provided to the group of users on the entire data communications network. Actions are taken when the group attempts to exceed either the local maximum number of sessions or the network-wide maximum number of sessions by more than a predetermined number. The actions may include assessing extra charges, denying access, and sending warning messages to appropriate recipients.

Proxy session count limitation

A data communications network with at least one PoP maintains a local cache database associated with each AAA service at the PoP on the data communications network. Each local database contains a group identification such as a domain identification corresponding to a group of users or an FQDN specifying a group of one individual, a maximum number of B-Channels to provide the group of users at the PoP and a dynamic B-Channel session count corresponding to active B-Channel connections currently provided to the group of users at the PoP. Actions are taken when the group attempts to exceed the maximum number of B-Channels by more than a predetermined number. The actions may include assessing extra charges, denying access, and sending warning messages to appropriate recipients. The local database may be synchronized by publishing B-Channel connection and disconnection events to all subscribing local databases. For proxy authentication users, the authentication information is published to the local caches of each AAA service at the PoP upon the first log-in of the user so as to avoid the need to proxy each successive connection authentication to a remote AAA service.

Growing community of inventors

Cupertino, CA, United States of America

Charles Troper Yager