Huawei Technologies Co., Limited

Yibin Xu

Bing Jiang Sun

Jun Li

Donghui Wang

Chunning Wang

Rong Yang

Penghe Tang

Cairen Weng

Sisheng Wang

This application discloses an access management method, an authenticator, and an authentication server, applied to a scenario in which a terminal device accesses a network. After completing authentication, a terminal device sends a first packet to an authenticator, where the first packet carries a first IPV6 address of the terminal device and a MAC address of the terminal device. When determining that the first IPV6 address is a new IPV6 address, the authenticator sends, to an authentication server, a second packet carrying the first IPV6 address and the MAC address, so as to indicate the authentication server to send a first authorization policy to a policy enforcement point based on the first IPV6 address.

Access management method, authenticator, and authentication server

An access control method, system, and a switch, pertains to the field of network technologies. The access control method includes receiving, by an authentication device, a packet from an access device, where the packet includes a virtual local area network (VLAN) identifier, and authenticating, by the authentication device based on the VLAN identifier and a preconfigured correspondence using an authentication method corresponding to the VLAN identifier, a terminal device sending the packet, where the correspondence includes a mapping from a plurality of VLAN identifiers to at least two authentication methods. Hence, the authentication method of the terminal device is determined based on the VLAN identifier such that different authentication methods may be used for terminal devices in different VLANs. Therefore, an access manner is flexible.

Access control method and system, and switch

A packet processing method, apparatus, and device are disclosed. The method includes: receiving, by a forwarding plane, an item from a control plane of the forwarding plane, where the item includes an identifier of a connected terminal; receiving an access protocol packet; when the access protocol packet is not an authentication start packet, determining, by the forwarding plane according to the identifier of the connected terminal, whether a terminal served by the access protocol packet is the connected terminal; and discarding, by the forwarding plane, the access protocol packet when the access protocol packet is not the authentication start packet and when the terminal served by the access protocol packet is not the connected terminal. The method improves user experience.

Packet processing method, apparatus, and device

A NAT entry management method and a NAT device are disclosed. The method includes: receiving and storing, by a NAT device, a connection parameter, where the connection parameter includes an address of a controller; receiving a packet sent by a network device, where a source address of the packet is a private address of the network device and a destination address of the packet is the address of the controller; performing NAT on the packet, where an after-NAT source address of the packet is a public address; and when a static entry condition is met, generating a target static NAT entry, where the static entry condition includes that the destination address of the packet is the address of the controller. This can prevent aging of the NAT entry from affecting communication between the network device and the controller.

NAT entry management method and NAT device

A network security method and a device relating to the field of network communication where the method includes, recording a correspondence between an Internet Protocol (IP) address and an security group tag (SGT), and executing a network security policy on a receiver of a data packet according to the recorded correspondence between the IP address and the SGT such that SGT information of the receiver does not need to be specially propagated, thereby decreasing network resource consumption and reducing network complexity.

Network security method and device

A method, an apparatus, and a system for controlling access of a user terminal, where the method includes receiving, by a controller, an authentication packet sent by an access switching node through an established data tunnel; obtaining, by the controller, a source media access control (MAC) address of the authentication packet; after access authentication implemented on a user terminal, determining, from a maintained correspondence between MAC addresses of user terminals and interface identifiers, an interface identifier corresponding to the MAC address of the successfully-authenticated user terminal, where the interface identifier identifies an interface connected to the user terminal; and sending, by the controller, the determined interface identifier to the access switching node through an established control tunnel, and instructing the access switching node to enable the interface corresponding to the interface identifier.

Method, apparatus, and system for controlling access of user terminal

A method and an apparatus for configuring a packet forwarding manner. The method includes receiving, by a control node (CN), a connection establishment request packet from a client device, and acquiring a user attribute according to the request packet; according to the user attribute and a forwarding policy, acquiring, by the first CN, a packet forwarding manner corresponding to the client device, where the forwarding policy includes a packet forwarding manner corresponding to the user attribute; and after authentication succeeds, sending, by the first CN, a message carrying the acquired packet forwarding manner to a wireless access point (AP) associated with the client device, so as to instruct the wireless AP to create a forwarding entry of the client device, where the forwarding entry includes the packet forwarding manner. The present invention implements user-based control of a packet forwarding manner, simplifying configuration and maintenance.

Method and apparatus for configuring packet forwarding manner

A packet transmission method, apparatus, and system in a multicast domain name system (mDNS), which are used to resolve a network bandwidth waste problem due to much service information needs to be transmitted in an mDNS-based network. The method includes, converting, by a relay, a known-answer service query packet that is sent by a user terminal and used to query service information in an mDNS, into a unicast known-answer service query packet and sending the unicast known-answer service query packet to a gateway, receiving, by the relay, a unicast known-answer service answer packet that is sent by the gateway and includes service information unknown to the user terminal, and converting, by the relay, the unicast known-answer service answer packet into a multicast known-answer service answer packet and sending the multicast known-answer service answer packet to the user terminal.

Packet transmission method, apparatus, and system in multicast domain name system

Embodiments of the present invention provide a service packet forwarding and processing method and system, and an access point AP. Change information of a packet forwarding path of a mobile terminal STA is obtained. A path update packet is sent to a forwarding device according to the change information of the packet forwarding path of the STA, so that the forwarding device performs update processing on the forwarding path of the STA according to the path update packet.

Service packet forwarding and processing method and system, and access point AP

The present disclosure discloses a message forwarding method, an Access Point, and a system. An Access Point obtains a forwarding configuration table, where the forwarding configuration table includes message types and forwarding modes; receives a message sent by a user station and obtains a message type of the message; determines the forwarding mode of the message according to the message type of the message and the forwarding configuration table; encapsulates and forwards the message according to the forwarding mode of the message. Through the present disclosure, forwarding control of messages of wireless users can be implemented on the Access Point, thereby avoiding the problem that wireless air interface control is separated from user access control on an AP controller (AC) in the local forwarding mode and the problem of waste of bandwidth between the AP and the AC in the tunnel forwarding mode.

Growing community of inventors

Nanjing, China

Yibin Xu