Cisco Technology, Inc.

Jason Frazier

Joseph Salowey

Ian Foo

Rajasekhar Manam

Joshua B Littlefield

Ramesh V N Ponnapalli

Susan Marie Sauter

Shengyou Zeng

Jacob Jensen

Shyam Kaluve

Gregory Alan Moore

Victor Manuel Moreno

Partha P Bhattacharya

Arthur Zavalkovsky

Jeremy Stieglitz

Khalil A Jabr

Hao Zhou

Jeevan Shashikant Patil

Ellis Roland Dobbins

S Scott Van De Houten

Troy H Sherman

Cynthia D Melter

Joseph A Salowey

Systems, methods, and other embodiments associated with flexible supplicant access control are described. One example method includes collecting a network information associated with a network to which an endpoint is to be communicatively coupled. The network information comprises a network identification and information to facilitate the evaluation of network threats. The example method may also include classifying the network based, at least in part, on the network information, to assign a variable level access parameter (VLAP) to the network based on the policy locally configured on the endpoint or centrally managed by the administrator. The VLAP may establish three or more access levels for the network at the endpoint. The example method may also include communicating the network identification and the network VLAP to a second endpoint, a security agent, a security application, and so on.

Flexible supplicant access control

According to one embodiment, a method for removing authentication of a supplicant includes monitoring communication between the supplicant and an authenticator. The method also includes determining, based on the monitored communication, the MAC address for the supplicant and an attachment port of the supplicant to the intermediate network device disposed between the supplicant and the authenticator through which the monitored communication occurs. The method also includes determining that the supplicant no longer has a link connection with the intermediate network device, and in response, sending via the intermediate network device a logoff message having a spoofed source address of the supplicant to the authenticator.

Method and system for removing authentication of a supplicant

An extensible authentication framework is used in cable networks such as Data Over Cable Service Interface Specification (DOCSIS) cable networks. The authentication scheme allows for centralized authentication of cable modems, as well as authentication of the cable network by cable modems. Additionally, the authentication scheme allows a Cable Modem Termination System (CMTS) to authenticate devices downstream from cable modems, such as Customer Premise Equipment (CPE) devices.

Authentication for devices located in cable networks

Configuring an interface of a switch includes sending an authentication request requesting authentication for an endpoint from a switch to an authentication server. The switch comprises interfaces and is operable to access templates, where a template is operable to generate one or more interface commands for an interface. An instruction is received from the authentication server. The instruction instructs the switch to apply an identified template to an interface, where the identified template is identified by the authentication server as associated with the endpoint. The identified template is applied to configure the interface according to the instruction.

Configuring interfaces of a switch using templates

A method, apparatus and computer program product for providing IP Routing when using dynamic virtual local area networks (VLANs) with web based authentication. A downstream VLAN is assigned to a first switch port of a first network device. A first upstream VLAN is also assigned to the first switch port of the first network device. The first upstream VLAN is changed to a second upstream VLAN upon authentication, and the downstream VLAN is maintained.

Method for IP routing when using dynamic VLANs with web based authentication

A method and system is disclosed for creating and tracking network sessions. A request to access a network is received from an entity. The entity is authenticated after the request is received. Authenticated identity information associated with the entity, network address information associated with the entity, and network location information associated with the entity is collected. An information set is created. The information set comprises and binds together the authenticated identity information, the network address information, and the network location information. The information set indicates a present association among the authenticated identity information, the network address information, and the network location information. The information set is stored in a session record in a centralized database. The session record represents a session in which the entity accesses the network. The session record is one of a plurality of session records that are stored in the centralized database. The plurality of session records is used by a data processing system to perform real-time diagnostics of the network.

Method and system for creating and tracking network sessions

Disclosed are apparatus and methods for authenticating a device to access a network through an access control port. In one embodiment, one or more first authentication packets for authenticating a first device or user to access a first network domain via a particular access port of a network device are received, for example, by an access control port. The particular access port is configured to control access for packets attempting to ingress into one or more network domains. When the first device or user is authorized to access the first domain, a first binding between the first device and the first domain is formed. The first binding specifies that the first device is allowed to access the first domain and the first binding is associated with the particular access port of the network device. When a packet is received that is attempting to ingress into the first domain and the ingressing packet matches the first binding, the ingressing packet is allowed to access the first domain. In contrast, when a packet is received that is attempting to ingress into the first domain and the ingressing packet does not match the first binding, the ingressing packet is blocked from accessing the first domain.

Apparatus and methods for supporting 802.1X in daisy chained devices

Growing community of inventors

Raleigh, NC, United States of America

Jason Frazier