Aruba Networks, Inc.

Rajesh Mirukula

Ramsundar Janakiraman

Brijesh Nambiar

Ravinder Verma

Mohd Shahnawaz Siraj

Berend Dunsbergen

Sathish Damodaran

Jie Cheng Jiang

Gopalakrishnan Raman

Prasad Palkar

Claudius Tewari

The present disclosure discloses a method and network device for control plane protection for various tables using storm prevention entries. Specifically, the disclosed system receives a first packet, and creates an inactive entry in a table. The system then forwards the first packet from a first processor to a second processor for processing. Also, the system associates the inactive entry with a timestamp indicating when the first packet is forwarded to the second processor, and determines a configured interval (CI) associated with the table. Further, the system compares a difference between a current timestamp and the timestamp associated with the inactive entry against the CI upon receiving a second packet. If the difference is longer than the CI, the system associates the inactive entry with the current timestamp, and forwards the second packet to the second processor for processing. Otherwise, the system discards the second packet.

Control plane protection for various tables using storm prevention entries

The present disclosure discloses a method and a network device for partitioning data sets for transmission on multiple physical links in a network. Specifically, a network device receives a particular data set addressed to a client device. The network device partitions the particular data set into at least a first subset of data and a second subset of data. Then, the network device encapsulates the first subset of data using a first header and encapsulating the second subset of data using a second header that results in (a) data with the first header being transmitted on a first physical link and (b) data with the second header being transmitted on a second physical link different than the first physical link. Finally, the network device transmits the first subset of data with the first header and the second subset of data with the second header.

Partitioning data sets for transmission on multiple physical links

The present disclosure discloses a method and network device for an enhanced serialization mechanism. Specifically, the disclosed system receives a plurality of packets from a plurality of transport layer flows corresponding to a security association. Also, the system designates one processor of a plurality of processors to be associated with the security association. Moreover, the system assigns a sequence number to each packet, and transmits the plurality of packets from the plurality of transport layer flows such that packets within the same transport layer flow are transmitted in order of their sequence numbers. However, at least two packets from two different transport layer flows may be transmitted out of incremental order of their sequence number.

Enhanced serialization mechanism

Assigning clients to VLANs on a digital network. A client attaching to a digital network through a network device is initially assigned to a first VLAN. This VLAN may have restricted access and is used for authentication. The device snoops DHCP traffic on this first VLAN rewriting DHCP traffic from the client to request a short lease time for the client. A short lease time may be on the order of 30 seconds. The device optionally rewrites DHCP traffic to the client on the first VLAN to assure a short lease time is returned; this rewriting supports DHCP servers which do not issue short leases. Traffic on this first VLAN may be limited to authentication such as captive portals, 802.1x, Kerberos, and the like. If client authentication on the first VLAN does not succeed, when the short lease expires, the client will receive another short lease on the first VLAN. The network device snoops authentication traffic. When authentication succeeds, the device snoops this traffic and derives information such as roles and the target VLAN for the client, saving this information. When the short DHCP lease expires for the client, and the client restarts the DHCP process, the device assigns the client to the target VLAN and all further processing occurs on this target VLAN.

Multimode authentication

Growing community of inventors

San Jose, CA, United States of America

Rajesh Mirukula