Cisco Technology, Inc.

Matthew Lawrence King

Richard Manfred Pruss

Murty Subba Rama Chandra Kotha

Pascal Thubert

Eric Michel Levy-Abegnoli

Mark Grayson

Frank Brockners

Ralph Droms

Richard Mandfred Pruss

Amit S Phadnis

Vinodh Kumar Ravindranath

Marco Cesare Centemeri

Richard A Johnson

Navneet Agarwal

Chaim Bendelac

Jeffrey David Haag

Edwin James Van Horne, Iii

Wayne Roiger

Francois Gagne

Kotha Subba Rama Chandra Murty

Shweta Choudaha

Tanja Hess

Julien Grobbelaar

David Hovey

Tirumali Seetharam Ajai

Richard Mandred Pruss

John Fitzgerald

In one embodiment, a method includes receiving a packet from an end node, the packet comprising an authenticated source MAC (Media Access Control) address and a source IP (Internet Protocol) address computed based on the authenticated source MAC address, and verifying the source IP address in the received packet, wherein verifying the source IP address comprises computing an IP address based on the authenticated source MAC address and comparing the computed IP address to the source IP address in the received packet to verify the source IP address. An apparatus is also disclosed herein.

Method and apparatus for verifying source addresses in a communication network

A service gateway maintains forwarding components operative to forward data packets within corresponding VPNs, and also maintains subscriber sessions for subscribers via respective subscriber interfaces. The association between the subscribers and the forwarding components is independent of the subscriber interfaces, such that the subscribers reachable via a given interface are associable with any forwarding component. Upon detecting an appropriate event, such as a service selection action, the service gateway modifies the forwarding components of first and second VPNs to reflect that the subscriber session is active in the second VPN and is not active in the first VPN. The service gateway also effects a change of a network address that identifies the corresponding subscriber from a first network address defined in the first VPN to a second network address defined in the second VPN. Mechanisms for effecting such a change of network address include DHCP, IPCP, RADIUS, and NAT. The service gateway employs control policies to govern the transfer of subscribers among VPNs.

Dynamic, policy based, per-subscriber selection and transfer among virtual private networks

A community translation service device for providing a translation service to a community of at least one source device is arranged to receive data traffic from a source device in the community. The traffic includes a native data session identifier and, as a source identifier, a source device identifier. The community translation service device comprises a translation component and a database for storing a pool of assigned data session identifiers associated with the source device. The translation component is arranged to translate the native data session identifier to an assigned data session identifier associated with the source device, the community translation service device further being arranged to forward the data traffic including the assigned data session identifier as data session source device information to a service aggregation device.

Apparatus and method for providing data session source device information

An improved technique for processing a DHCP request from a DHCP client device is performed in a data communications device of a network (e.g., performed in a router). The technique involves receiving the DHCP request from the DHCP client device, evaluating a set of rules in response to the DHCP request to obtain a rule-based classification result, and outputting a DHCP response in response to the rule-based classification result. In some arrangements, a policy manager which is external to the data communications device plays a role in the classification process (e.g., dynamic updating of the set of rules, responding to individual queries from the data communications device when generating the rule-based classification result, etc.). Such improvements over conventional DHCP approaches enables improved flexibility and coordination of the DHCP process.

Methods and apparatus for processing a DHCP request using rule-based classification

An edge router termed a 'service gateway' operates to reassign network addresses such as Internet Protocol (IP) addresses to a subscriber, such as when the subscriber is to be transitioned from a first virtual private network (VPN) to a second VPN. The service gateway obtains a new network address routable in a second VPN and applies dynamic edge network address translation (NAT) on an interim basis to provide instant access to the second VPN (following web-based identification for example), while a prior lease for an initial network address not routable in the second VPN is still in effect. When the subscriber attempts to renew the lease in due course, the renewal request is rejected, which forces the subscriber to re-initiate dynamic host control protocol (DHCP) procedures to obtain a new network address. At this point, the interim NAT mapping is removed and the new network address is assigned directly to the subscriber via DHCP. This approach combines the benefits of DHCP and NAT while minimizing dead time on the network and the processing overhead associated with alternative approaches.

Method and apparatus for dynamic network address reassignment employing interim network address translation

A method is disclosed for authorizing a prepaid network service in a data network. A network end station issues a request for a prepaid network service. At a network node, such as a router serving as a gateway for selecting services, a determination is made about whether a user associated with the end station is authorized to access the prepaid network service. Network traffic from the end station is forwarded to a service provider only when the user is authorized to use the prepaid network service. Specific embodiments provide message flows among a mobile station, gateway support node, router, and authentication server that support providing prepaid services in a packet-switched network for mobile communication. In certain embodiments, a connection is held open for an end station while a prepaid quota value is refreshed at a portal, thereby reducing overhead and precluding the need to repeat user logon steps. Further, unused quota amounts can be returned to the authentication server for use in association with multiple concurrent connections of the same device.

Method and apparatus providing prepaid billing for network services using explicit service authorization in an access server

A method is disclosed for policy-based determination of a network address for a client in a network. A request for a network address is received from a client. A policy response is received that identifies a scope of network addresses for the client. A request source address value in the client request is modified, based on the policy response. The modified client request is sent to a server that can assign network addresses within the identified scope. A network address for the client is received, which has been assigned by the server within the identified scope. The network address is provided to the client. A specific embodiment modifies a 'giaddr' field value in a DHCP request, before relaying the request to a DHCP server, based on a policy decision that specifies a scope to be used for the network address of the client.

Method and apparatus providing policy-based determination of network addresses

Growing community of inventors

Headley Down, United Kingdom

Matthew Lawrence King