Hewlett Packard Enterprise Development LP

New H3c Technologies Co., Ltd.

Hangzhou H3c Technologies Co., Ltd

Xiaopeng Yang

Yubing Song

Min Zheng

Shilin Zhang

Ruichang Gao

This disclosure provides a method and device for controlling network access. According to the method, an aggregation switch may configure thereon an ACL rule comprising a first network segment and a second network segment, wherein the first network segment and the second network segment correspond to a same user group or different user groups, or the first network segment corresponds to a user group and the second network segment corresponds to a resource group. The aggregation switch may, after receiving a user packet from an access switch, match a source IP address of the user packet with the first network segment, and a destination IP address of the user packet with the second network segment. If the source IP address of the user packet matches with the first network segment and the destination IP address of the user packet matches with the second network segment, the user packet is discarded.

Network access control

In an example, a method of routing management is provided, wherein the method applied in a device for forwarding packet, which includes a main control board, fabric boards and line cards. The main control board may transmit routing entries to one or multiple fabric boards in the device according to a preset entry distribution strategy, transmit routing distribution information for indicating correspondence between each fabric board and a packet character of the routing entries stored in the fabric board to each of the line cards, so that the line card transmits a packet matching the packet character to a corresponding fabric board to be forwarded, according to the routing distribution information.

Routing management

A gateway RB may search for an ARP entry of the destination IP address of an IP packet. The gateway RB may generate an Ethernet header based on a VLAN identification and a MAC address in the found ARP entry and a first local MAC address. The gateway RB may generate an Ethernet packet by adding the generated Ethernet header to the IP packet, and send out the Ethernet packet via an egress port in the found ARP entry; wherein the founded ARP entry is generated by the gateway RB based on a received TRILL-encapsulated ARP packet and a VSI on the gateway RB associating with the first local MAC address and the destination IP address of the IP packet belong to the same VLAN.

Packet forwarding

An edge switch receives a VM classification policy and an executing policy corresponding to each VM class distributed by a policy controller. The executing policy comprises information of each service node for processing a message and an executing sequence of the each service node. The edge switch receives a message sent by a VM connected to the edge switch, determines a VM class corresponding to the message according to the VM classification policy and determines an executing policy corresponding to the VM class. The edge switch encapsulates the message according to information of each service node to be executed by a VM of the VM class and an executing sequence, and sends the message, so that the message is sequentially sent to the each service node to be executed by the VM of the VM class to execute a service policy.

Services execution

A first access switch in the first Fabric receives a notification sent by a second access switch in the first Fabric, and the notification includes a nickname of the second access switch. The first access switch identifies an egress interface to a TRILL path from the first access switch to an access switch corresponding to the nickname in the notification. The first access switch stores the egress interface to the TRILL path in a fiber channel (FC) forwarding table. The first access switch forwards a received FCoE packet by using the egress interface stored in the FC forwarding table. The FCoE packet is forwarded by the first access switch without encapsulation with a TRILL header.

Forwarding packets

A method and device for processing source role information in which a source role tag is inserted into a packet as an inner VLAN tag of the packet and used to perform role based access control processing for the packet.

Growing community of inventors

Beijing, China

Xiaopeng Yang