Hewlett Packard Enterprise Development LP

Mohan Ram Bhadravati Ramakrishna Bhat

Piyush Agarwal

Sachin Ganu

Hao Lu

Haifeng Zhang

Narayanasami Vijayaraghavan

Shreekanthayya Hiremath

Nilay Shroff

Raghunandan Prabhakar

Shravan Kumar Vuggrala

Xiaoding Shang

Mahesh Dantakale

Systems and methods are provided for authenticating client devices in microbranch deployment. In response to a client device connecting to a LAN AP, a first client-entry associated with the client device can be created to indicate that the client device is local to the LAN AP. An authentication request can be transmitted to a WAN AP to be forwarded to an authentication server. A second client-entry associated with the client device at the WAN AP can be created based on the authentication request. Upon successful authentication, the second client-entry can be designated as being foreign to the WAN AP based on the first client-entry being local to the LAN AP. Accordingly, data packets from the client device can be analyzed via a first firewall of the LAN AP, while bypassing a second firewall of the WAN AP based on the foreign designation of the second client-entry at the WAN AP.

Multi AP microbranch deployment configuration based on optimized packet forwarding

Systems and methods are provided for prevent network outages and improve communication effectiveness by implementing an automatic discovery method that enables the AP to act dynamically to determine its persona as a WAN AP or LAN AP. Based on the determination, the AP can receive the appropriate configuration settings in a configuration file from the central controller (e.g., Aruba central config service) for its dynamic persona. In some examples, the administrator user may define an AP identifier (e.g., MAC addresses) of the network devices in the corresponding microbranch for authentication and authorization.

Automatic discovery of access point (AP) persona and configuration derivation in multi AP microbranch deployment

Systems and methods are provided for seamless roaming in a network. First, a client device is authenticated at a first access point of the network. Next, a processor selectively determines, among remaining access points in the network, second access points at which respective precursor keys, such as Pairwise Master Keys R1 (PMK-R1s) are to be computed. The second access points are determined based on any of respective path losses from the first access point to the second access points and respective historical frequencies at which the client device associates at the respective remaining access points. For the second access points, the respective PMK-R1s are computed and transmitted to the second access points to be cached. Next, following a request from the client device to reassociate to a second access point of the second access points, the client device is authenticated at the second access point based on a corresponding PMK-R1.

Selective caching of pairwise master keys in streamlined roaming

Some examples relate to distributing application classification entries to network devices. An example includes receiving, by a processing resource in a cloud computing system, an application classification entry for an application from respective network devices on a network. The application classification entry may comprise a given application identifier for identifying the application and control information for routing a network packet originating from the application. For the given application identifier, the processing resource may generate a consolidated set of application classification entries, based on the application classification entry received from respective network devices. The processing resource may then determine appropriate network devices to distribute the consolidated set of application classification entries.

Application classification distribution to network devices

Some examples relate to controlling network traffic pertaining to a domain name based on a Domain Name System-Internet Protocol address (DNS-IP) mapping, An example includes receiving, in a cloud computing system, a local DNS-IP mapping for a domain name from respective Access Points (APs) in a virtual local area network (VLAN) along with geographical information of respective APs; generating a global DNS-IP mapping database comprising the local DNS-IP mapping for the domain name received from respective APs in the VLAN along with geographical information of respective APs, in the cloud computing system; and determining appropriate APs to distribute the global DNS-IP mapping, based on location information of respective APs.

Growing community of inventors

Bengaluru, India

Mohan Ram Bhadravati Ramakrishna Bhat