Local network natification

• US 20040030765A1
• Filed: 08/12/2002
• Published: 02/12/2004
• Est. Priority Date: 08/12/2002
• Status: Abandoned Application

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Sadot, Emek, Zilbershtein, Itai Ephraim
• Application Number:
  US10/217,069
• Publication Number:
  US 20040030765A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/308 Route determination based on user's profile, e.g. premium users
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A method of providing policy enforcement within a network. The method includes receiving a packet by a first network element at an entrance to the network, replacing a value of an address field of the packet to an internal address related to a policy profile according to which the packet is to be handled, forwarding the packet to a second network element in the network, and handling the packet in accordance with a policy profile determined from the internal address in the address field of the packet.

Claims

1. A method of providing policy enforcement within a network, comprising:

receiving a packet by a first network element at an entrance to the network;

replacing a value of an address field of the packet to an internal address related to a policy profile according to which the packet is to be handled;

forwarding the packet to a second network element in the network; and

handling the packet in accordance with a policy profile determined from the internal address in the address field of the packet.

2. A method according to claim 1, wherein replacing the value of the address field comprises replacing the value of a source address field for packets generated outside the network.

3. A method according to claim 1, comprising replacing the value of a destination address field of packets generated within the network.

4. A method according to claim 1, comprising replacing the value of at least one field in addition to the field changed to the internal address.

5. A method according to claim 4, wherein the at least one additional field comprises an additional address field.

6. A method according to claim 4, wherein the at least one additional field comprises a protocol port field.

7. A method according to claim 4, wherein the at least one additional field is changed to a value not related to the policy profile of the packet.

8. A method according to claim 1, wherein the internal address is selected responsive to a previously performed authentication session with a client that transmitted the packet.

9. A method according to claim 8, wherein the authentication session determines a single internal address to be used by the client, for all connections of the client.

10. A method according to claim 8, wherein the single internal address may be used by a plurality of different clients deserving a same policy profile.

11. A method according to claim 8, wherein the authentication session determines one or more internal addresses to be used by the client, depending on the number of profiles required by different types of connections of the client.

12. A method according to claim 8, wherein handling the packet in accordance with the policy profile comprises handling in accordance with a rule set transmitted to the second network element responsive to the authentication session.

13. A method according to claim 1, wherein the internal address is assigned to a client that transmitted the packet and the internal address is not used by other clients as long as the client is connected to the network.

14. A method according to claim 13, wherein the internal address is not used by other clients even when the client is not connected to the network.

15. A method according to claim 1, wherein handling the packet in accordance with the policy profile comprises handling in accordance with a rule set configured into the second network element by a system manager.

16. A method according to claim 1, wherein handling the packet in accordance with the policy profile comprises handling in accordance with a rule set configured into the second network before any packets were received by the first network element from the client that transmitted the received packet.

17. A method according to claim 1, wherein handling the packet in accordance with the policy profile comprises determining whether to forward the packet towards its destination.

18. A method according to claim 1, wherein handling the packet in accordance with the policy profile comprises handling with a QoS of the policy profile.

19. A method according to claim 1, wherein handling the packet in accordance with the policy profile comprises handling with the same policy profile as packets directed in an opposite direction on a same two-way connection as the received packet.

20. A method according to claim 1, wherein handling the packet in accordance with the policy profile comprises handling with a different policy profile than packets directed in an opposite direction on a same two-way connection as the received packet.

21. A network element, comprising:

a input interface adapted to receive packets;

a replacement unit adapted to replace a source address field of the packets with respective internal addresses; and

a policy determination unit adapted to determine policy profiles of clients and to configure the replacement unit with internal addresses to be inserted into packets received from clients according to the determined policy profiles of the clients.

22. A network element according to claim 21, wherein the replacement unit is adapted to replace at least one additional field of the packets.

23. A network element according to claim 21, wherein the replacement unit is adapted to replace the internal addresses back to the replaced values of the source address field.

24. A method of providing policy enforcement within a network, comprising:

receiving a packet by a first network element at an entrance to the network;

assigning a value related to a policy profile according to which the packet is to be handled to a virtual local area network (VLAN) field of the packet;

forwarding the packet to a second network element in the network; and

handling the packet in accordance with a policy profile determined from the value assigned to the VLAN field of the packet.

25. A method according to claim 24, wherein assigning the value to a VLAN field comprises replacing an existing value.

26. A method according to claim 24, wherein assigning the value to a VLAN field comprises adding a portion including a VLAN field to the packet and assigning the value to the VLAN field of the added portion.

27. A method of changing packet addresses, comprising:

receiving a packet by a first network element;

selecting an address to which an address field of the packet is to be changed, based on a value of at least one field of the received packet; and

replacing the value of the address field of the packet to the selected address.

28. A method according to claim 27, wherein selecting the address comprises selecting an address at least partially based on at least one of a source or destination address of the received packet.

29. A method according to claim 27, wherein selecting the address comprises selecting an address at least partially based on a protocol of the received packet.

30. A method according to claim 27, wherein selecting the address comprises selecting an address at least partially based on login information received from the client from which the received packet was received.

31. A method according to claim 27, wherein selecting the address comprises selecting an address at least partially based on a web page requested by the client from which the received packet was received.