Methods, systems, and computer program products for dynamic network access device port and user device configuration for implementing device-based and user-based policies

• US 20060274774A1
• Filed: 06/07/2005
• Published: 12/07/2006
• Est. Priority Date: 06/07/2005
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Extreme Networks, Inc.
• Inventors: Nagarajan, Rajasekaran, Ronne, Jeffrey A., Srinivasan, Balaji, Suizo, Nick G., Gidwani, Abhay, Saravanan, Desikan, Lochner, Wolfgang
• Granted Patent: US 8,775,571 B2
• Time in Patent Office: Days
• US Class Current: 370/420
• CPC Class Codes: H04L 41/0809 Plug-and-play configuration
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: Y02D 30/00 Reducing energy consumption in communication networks

Abstract

Methods, systems, and computer program products for dynamic network access device port and user device configuration are disclosed. According to one method, when a user device is connected to a port of a network access device, the type of user device is determined. The type of user device is used to locate a corresponding port configuration policy. The port to which the device is connected is dynamically configured based on the port configuration policy.

Claims

1. A method for dynamic network access device port configuration, the method comprising:

(a) storing at least one mapping between a user device type and at least one port configuration parameter corresponding to the user device type;

(b) determining a device type of a user device plugged into a port of a network access device;

(c) extracting a port configuration parameter from the at least one stored mapping corresponding to the user device type; and

(d) dynamically configuring the port using the configuration parameter.

2. The method of claim 1 wherein storing at least one mapping includes storing the at least one mapping at a server separate from the network access device.

3. The method of claim 1 wherein storing at least one mapping includes storing the at least one mapping at the network access device.

4. The method of claim 1 wherein storing at least one mapping includes storing a plurality of different mappings between a plurality of different user device types and corresponding port configurations.

5. The method of claim 4 wherein storing a plurality of different mappings for a plurality of different device types includes storing mappings for at least one of an IP phone, a wireless access point, a personal computer, and a soft phone and corresponding port configuration information.

6. The method of claim 1 wherein determining a user device type includes determining the user device type in response to the user device being connected to the port.

7. The method of claim 6 wherein determining the user device type includes exchanging messages with the user device via the port.

8. The method of claim 7 wherein exchanging messages with the user device includes exchanging link layer discovery protocol (LLDP) messages with the user device.

9. The method of claim 1 wherein determining a user device type includes determining the user device type based on a medium access control (MAC) address of the user device.

10. The method of claim 1 wherein determining a user device type includes determining the user device type based on an identifier assigned to the user device type.

11. The method of claim 1 wherein dynamically configuring the port includes configuring the port to implement at least one of an access control list, a quality of service parameter, and a VLAN corresponding to the user device type.

12. The method of claim 1 wherein dynamically configuring the port includes substituting user-device-specific attributes for generic port configuration parameters defined by an administrator.

13. The method of claim 1 comprising detecting a new device being plugged into the port and repeating steps (b)-(d) for automatically configuring the port to function with the new device.

14. The method of claim 13 wherein repeating steps (b)-(d) includes repeating steps (b)-(d) without requiring intervention from an administrator.

15. The method of claim 1 comprising dynamically configuring the user device in response to the user device being connected to the port.

16. The method of claim 15 wherein dynamically configuring the user device includes downloading device configuration parameters from the network access device to the user device via the port.

17. The method of claim 1 wherein the network access device comprises an Ethernet switch.

18. The method of claim 1 wherein the network access device comprises an IP router.

19. A method for dynamically configuring a port of a network access devise-based on user group information, the method comprising:

(a) storing at least one association between a user group and a group-based network access policy;

(b) detecting a user connecting to a port of network access device;

(c) determining a user group to which the user belongs;

(d) extracting a user-based network access policy corresponding to the user group from the at least one stored association; and

(e) dynamically configuring the port to implement the user-based network access policy.

20. The method of claim 19 wherein storing the at least one association includes storing the at least one association at the network access device.

21. The method of claim 19 wherein storing the at least one association includes storing the at least one association at a location separate from the network access device.

22. The method of claim 19 wherein detecting a user connecting to a port of a network access device includes receiving an authentication request from a user connecting to the network access device via a user device.

23. The method of claim 22 wherein the user device selected from a group consisting of:

a personal computer, an IP phone, and a soft phone.

24. The system of claim 22 wherein determining a user group includes performing a lookup in a user group database based on information extracted from the authentication request.

25. The method of claim 19 wherein dynamically configuring the port to implement the user-based network access policy includes dynamically configuring the port to implement at least one of a VLAN-based access restriction, a MAC-address-based access restriction, and an IP-address-based access restriction.

26. The method of claim 19 wherein dynamically configuring the port to implement the user-based network access policy includes dynamically configuring the port to implement a time-based network access restriction.

27. The method of claim 19 wherein dynamically configuring the port to implement a user-based network access policy includes dynamically configuring the port in response to receiving a user group identifier from an authentication server.

28. The method of claim 19 comprising detecting a new network user connecting to the port of the network access device and repeating steps (c)-(e) for the new user.

29. The method of claim 28 wherein repeating steps (c)-(e) includes repeating steps (c)-(e) without intervention from a network administrator.

30. The method of claim 19 wherein the network access device comprises an Ethernet switch.

31. The method of claim 19 wherein the network access device comprises an IP router.

32. A system for dynamic network access device port configuration, the system comprising:

(a) at least one port for providing physical access to a network; and

(b) a dynamic device/port configurator for determining a type of device connected to the at least one port and for dynamically configuring the at least one port based on the user device type using at least one stored port configuration parameter corresponding to the user device type.

33. The system of claim 32 comprising a network management server for storing the at least one port configuration parameter.

34. The system of claim 32 wherein the dynamic device/port configurator is adapted to extract the at least one stored port configuration parameter from a database local to the dynamic device/port configurator.

35. The system of claim 32 wherein the dynamic device/port configurator is adapted to store mappings between a plurality of different device types and corresponding network access device port configuration data.

36. The system of claim 35 wherein the plurality of different device types includes at least one of IP phones, wireless access points, personal computers, and soft phones.

37. The system of claim 32 wherein the dynamic device/port configurator is adapted to determine the user device type in response to the user device being connected to the port.

38. The system of claim 37 wherein the dynamic device/port configurator is adapted to exchange messages with the user device in order to determine the user device type.

39. The system of claim 38 wherein the messages include link layer discovery protocol (LLDP) messages.

40. The system of claim 32 wherein the dynamic device/port configurator is adapted to determine the user device type based on a medium access control (MAC) address of the user device.

41. The system of claim 32 wherein the dynamic device/port configurator is adapted to determine the user device type based on an identifier assigned to the user device.

42. The system of claim 32 wherein the dynamic device/port configurator is adapted to configure the port to implement at least one of an access control list, a VLAN, and a quality of service parameter corresponding to the user device type.

43. The system of claim 32 wherein the dynamic device/port configurator is adapted to dynamically reconfigure the port in response to detecting a new user device being connected to the port.

44. The system of claim 32 wherein the dynamic device/port configurator is adapted to dynamically configure the user device in response to the user device being connected to the port.

45. The system of claim 32 wherein the dynamic device/port configurator is adapted to detect a user connecting to the port and to dynamically configure the port to implement a first user-based network access policy for the user.

46. The system of claim 45 wherein the first user-based network access policy includes at least one of a MAC-address-based, a VLAN-based, and an IP-address-based network access restriction.

47. The system of claim 45 wherein the first user-based network access policy includes a time-based network access restriction.

48. The system of claim 45 wherein the dynamic device/port configurator is adapted to select the first user-based network access policy based on a user group to which the user belongs.

49. The system of claim 45 comprising, in response to detecting a new user connecting to the port, the dynamic device/port configurator is adapted to dynamically configure the port to implement a second user-based network access policy different from the first user-based network access policy.

50. The system of claim 45 wherein the dynamic device/port configurator is adapted to implement the first user-based network access policy in response to an authentication request from the user.

51. The system of claim 45 wherein the dynamic device/port configurator is adapted to implement the first user-based network access policy in response to receiving a user group ID from a server.

52. The system of claim 32 wherein the port comprises a port of an Ethernet switch.

53. The system of claim 32 wherein the port comprises a port of an IP router.

54. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) storing at least one mapping between a user device type and at least one port configuration parameter corresponding to the user device type;

(b) determining a device type of a user device plugged into a port of a network access device;

(c) extracting a port configuration parameter from the at least one stored mapping corresponding to the device type; and

(d) dynamically configuring the port using the configuration parameter.

55. A computer program product comprising computer-executable instructions embodied in a computer-readable medium for performing steps comprising:

(a) storing at least one association between a user group and a group-based network access policy;

(b) detecting a network user connecting to a port of network access device;

(c) determining a user group to which the user belongs;

(d) extracting a user-based network access policy corresponding to the user group from the at least one stored association; and

(e) dynamically configuring the port to implement the user-based network access policy.