Cisco Technology, Inc.

Kaushik Kumar Dam

Sanjay Kumar Hooda

Atri Indiresan

Syam Sundar V Appala

Shivangi Sharma

Vimarsh Puneet

Sandesh Kumar Narappa Bheemanakone

Victor Manuel Moreno

Shyamsundar Nandkishor Maniyar

Anand Pulicat Gopalakrishnan

Gopakumar Choorakkot Edakkunni

Larry Tzuchu Chang

Mohamed Elgendy

Da-Yuan Tung

Micah Raphael Nishimura-Simmons

A policy server correlates information from several messages associated with a client device to implement an identity-based network access policy. A network element connected to the client device obtains an authentication message including a first network address from the client device. The network element provides the authentication device to an identity server via a Network Address Translation (NAT) device, which translates the first network address to a second network address. The network element also provides a first message including the first network address to the policy server to request an identity-based policy for network communications of the client device. The network element implements the identity-based policy authorized by the policy server.

Identity-based policy implementation in network address translation (NAT) environments

Client address based forwarding of dynamic host configuration protocol response packets may be provided. First, a first relay agent on a first network device may receive a first discovery message associated with a first client device. The first discovery message may include a first discovery message identifier field comprising a first identifier corresponding to the first client device. The first client device may be associated with a subnet. Then the first relay agent may register, with a map server, the first identifier with an address of the first network device and add a gateway address corresponding to the first relay agent to the first discovery message. Next, the first relay agent may encapsulate the first discovery message and forward the encapsulated first discovery message over a network to a border device.

Client address based forwarding of dynamic host configuration protocol response packets

In one embodiment a network device includes a plurality of ports. The network device is adapted to receive at least one configuring instruction, and adapted, after receipt of any of the at least one configuring instruction, to configure one or more access ports, of the plurality of ports, for endpoint virtual local area network (VLAN) assignment that is in accordance with at least one VLAN assignment algorithm. The at least one VLAN assignment algorithm allows at least two endpoints to be assigned to at least two different respective VLANs of a plurality of VLANs in a network, the at least one VLAN assignment algorithm enabling the at least two endpoints to connect to a same access port of the one or more access ports and provide data which is not VLAN tagged when received at the same access port.

Access port for one or more VLANs

A policy server correlates information from several messages associated with a client device to implement an identity-based network access policy. The policy server receives a first message from a network element connected to the client device. The first message requests an identity-based policy for the client device, and includes a first network address. The policy server receives a second message from an identity server. The second message includes information indicating an identity role and a second network address. The policy server receives a third message from a NAT device. The third message includes a NAT mapping that correlates the first network address with the second network address. After the policy server determines the identity-based policy based on a combination of the first message, the second message, and the third message, the policy server implements the identity-based policy in the network element.

Group based multicasts may be provided. First, a request may be received. The request may comprise a receiver tag, a request source identifier, and a request multicast group identifier. Next, a source tag corresponding to the request source identifier may be obtained and then it may be determined that a group corresponding to the receiver tag is allowed to access content from a source corresponding to the obtained source tag. In response to determining that the group corresponding to the receiver tag is allowed to access content from the source corresponding to the obtained source tag, content may be received from the source at a multicast group corresponding to the request multicast group identifier. The content may then be forwarded to a receiver corresponding to the request.

Group based multicast in networks

In one embodiment, a logical packet switching device has its switching fabric extended between multiple physical devices, such as, but not limited to, over one or more networks (e.g., over tunnel(s), point-to-point link(s), and/or public and/or private L2 or L3 network(s)). In particular, one embodiment extends the switching fabric between multiple different physical devices by effectively merging, at least from the perspective of ingress and/or egress line cards, a switching fabric in each of these multiple different physical devices. In this regard, an ingress lookup operation in a first physical device of one embodiment produces information which is used by the switching fabric in a different physical device to forward a packet to the appropriate egress line card in the different physical device. Further, one embodiment includes line cards which can be used to both extend the switching fabric as well as communicate with packet switching and other devices that are independent of the logical packet switching device.

Growing community of inventors

San Jose, CA, United States of America

Kaushik Kumar Dam