Centralized configuration with dynamic distributed address management

• US 9,787,632 B2
• Filed: 04/30/2015
• Issued: 10/10/2017
• Est. Priority Date: 10/21/2011
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Baniqued, Joseph Garcia, Dwivedi, Deepika, PalChaudhuri, Santashil, Unnimadhavan, Sandeep, Yadav, Brijesh Kumar, Adhya, Tilak Kumar, Manoharan, Rajalakshmi
• Primary Examiner(s): Lwin, Maung
• Application Number:
  US14/701,005
• Publication Number:
  US 20150237002A1
• Time in Patent Office: 894 Days
• Field of Search: None
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

The present disclosure discloses a network device and/or method for centralized configuration with dynamic distributed address management. The disclosed network device receives, at a first network node, a range of sub network addresses and a specified size for a sub network. The disclosed network device then divides the range of sub network addresses into a plurality of sub-ranges of sub network addresses based on the specified size. Further, the network device allocates the plurality of sub-ranges of sub network addresses to a plurality of sub networks, and transmits an allocated sub-range of sub network addresses to a corresponding sub network at a second network node through an established secure communication channel. Moreover, the network device can retrieve a profile template that includes the range of sub network addresses and the specified size of the sub network; and create a profile based on the profile template.

Claims

1. A computer implemented method, comprising:

establishing a secure communication channel to transmit a heartbeat message between a plurality of remote network nodes and a remote node controller over a public network, using a network address for the remote node controller;

receiving, from the plurality of remote network nodes, the heartbeat message;

transmitting, using the secure communication channel, a response heartbeat message to the plurality of remote network nodes, including a particular remote network node, wherein;

the response heartbeat message is the same as the heartbeat message; and

the response heartbeat message to the particular remote node indicates that the remote node controller has exceeded its capacity to update a network configuration for the particular remote network node;

receiving the network configuration for the particular remote network node over the secure communication channel when the remote node controller has capacity to update the network configuration, wherein the network configuration;

includes a network address allocation for a remote network device and a set of network addresses for dynamically allocating to devices connected to the particular remote network node; and

facilitates continued functioning of the particular remote network node when the remote node controller is unreachable from the particular remote network node; and

determining a subset of network addresses of the set of network addresses to reserve for a sub-network connected to the particular remote network node, by receiving a specified size and assigning a size for the subset that is a smallest integer power of two that is greater than the specified size; and

transmitting a sub-network profile to the sub-network, wherein the sub-network profile includes the subset of network addresses.

2. The method of claim 1, wherein the sub-network profile includes at least a starting address of the subset of network addresses and a number of hosts supported by the subset of network addresses.

3. The method of claim 1, wherein the remote network device is a remote access point for wirelessly connecting sub-network access points to the particular remote network node, the method further including:

receiving the sub-network profile at a sub-network access point;

allocating one address of the subset of network addresses to the sub-network access point and reserving a remainder of the subset of network addresses for dynamic allocation;

wherein the sub-network access point is a wireless access point for wirelessly connecting client devices to the sub-network.

4. The method of claim 1, further comprising:

in response to receiving the response heartbeat message that is different from the heartbeat message;

transmitting a local configuration request using the secure communication channel, wherein the local configuration request includes a request for updated network configuration information for the particular remote network node; and

receiving a local configuration response using the secure communication channel, wherein the local configuration response includes an updated network configuration for the particular remote network node.

5. The method of claim 1, further comprising:

dynamically allocating network addresses from the set of network addresses when the remote node controller is unreachable from the particular remote network node.

6. The method of claim 1, wherein network traffic between the particular remote network node and a central network node is routed through the secure communication channel, and wherein the secure communication channel facilitates creation of a Layer-2 network that extends across the particular remote network node and the central network node.

7. The method of claim 1, wherein the secure communication channel is a generic routing encapsulation tunnel or an Internet Protocol Security (IPSec) connection.

8. The method of claim 1, wherein determining the subset of network addresses includes receiving an identifier and a size of the subset and generating a subnet mask using the identifier and the size.

9. A system comprising:

a processor; and

a non-transitory computer readable medium including instructions executable by the processor to;

establish a secure communication channel to transmit a heartbeat message between a remote network node connected to a remote network device and a remote node controller over a public network, using a network address for the remote node controller;

receive, from the remote network node, the heartbeat message;

transmit, using the secure communication channel, a response heartbeat message to a plurality of remote network nodes, including the remote network node, wherein;

the response heartbeat message is the same as the heartbeat message; and

the response heartbeat message to the remote network node indicates that the remote node controller has exceeded its capacity to update a network configuration for the remote network node;

receive the network configuration for the remote network node over the secure communication channel when the remote node controller has the capacity to update the network configuration, wherein the network configuration includes a network address allocation for the remote network device and a set of network addresses for dynamically allocating to devices connected to the remote network node, wherein the set of network addresses correspond to routable addresses for a central network node;

dynamically allocate network addresses from the set of network addresses when the remote node controller is unreachable;

determine a subset of network addresses of the set of network addresses to reserve for a sub-network connected to the remote network node, by receiving a specified size and assigning a size for the subset that is a smallest integer power of two that is greater than the specified size; and

transmit a sub-network profile to the sub-network, wherein the subnetwork profile includes the subset of network addresses.

10. The system of claim 9, wherein the sub-network profile includes at least a starting address of the subset of network addresses and a number of hosts supported by the subset of network addresses.

11. The system of claim 9, wherein the remote network device is a remote access point for wirelessly connecting sub-network access points to the remote network node, and wherein the sub-network access point is a wireless access point for wirelessly connecting client devices to the sub-network.

12. The system of claim 9, further including instructions executable by the processor to:

in response to receipt of the response heartbeat message that is different from the heartbeat message;

transmit a local configuration request using the secure communication channel, wherein the local configuration request includes a request for updated network configuration information for the remote network node; and

receive a local configuration response using the secure communication channel, wherein the local configuration response includes an updated network configuration for the remote network node.

13. The system of claim 9, wherein the instructions to dynamically allocate network addresses from the set of network addresses include instructions to dynamically allocate the network addresses when the remote node controller at the central network node is unreachable from the remote network node.

14. The system of claim 9, further comprising instructions executable by the processor to:

route network traffic between the remote network node and the central network node through the secure communication channel, wherein the secure communication channel facilitates creation of a Layer-2 network that extends across the remote network node and the central network node.

15. The system of claim 9, wherein the secure communication channel is a generic routing encapsulation tunnel or an Internet Protocol Security (IPSec) connection.

16. The system of claim 9, wherein the instructions to determine the subset of network addresses includes instructions executable by the processor to:

receive an identifier and a size of the subset; and

generate a subnet mask using the identifier and the size.

17. A non-transitory computer readable medium comprising instructions executable by a processor to:

establish a secure communication channel to transmit a heartbeat message between a remote network device connected to a remote network node and a remote node controller over a public network, using a network address for the remote node controller;

receive, from the remote network node, the heartbeat message;

transmit, using the secure communication channel, a response heartbeat message to a plurality of remote network nodes, wherein;

the response heartbeat message is the same as the heartbeat message; and

the response heartbeat message to the remote network node indicates that the remote node controller has exceeded its capacity to update a network configuration for the plurality of remote network nodes; and

the response heartbeat message includes a masked heartbeat message to a second remote network node among the plurality of remote network nodes, based on the exceeded capacity of the remote node controller;

receive a first network configuration for a first remote network node among the plurality of remote network nodes over the secure communication channel when the remote node controller has the capacity to update the network configuration, wherein the first network configuration includes a network address allocation for the remote network device and a set of network addresses for dynamically allocating to devices connected to the first remote network node, wherein the set of network addresses correspond to routable addresses for a central network node, wherein the first network configuration facilitates continued functioning of the first remote network node when the remote node controller at the central network node is unreachable from the first remote network node; and

dynamically allocate network addresses from the set of network addresses when the remote node controller at the central network node is unreachable from the first remote network node.

18. The non-transitory computer readable medium of claim 17, further comprising instructions that are executed by one or more processors to perform operations including to:

in response to receipt of the response heartbeat message that is different from the heartbeat message;

transmit a local configuration request using the secure communication channel, wherein the local configuration request includes a request for updated network configuration information for the remote network node; and

receive a local configuration response using the secure communication channel, wherein the local configuration response includes an updated network configuration for the first remote network node.

19. The non-transitory computer readable medium of claim 17, wherein network addresses from the set of network addresses continue to be dynamically allocated when the remote node controller at the central network node is unreachable from the first remote network node.

20. The non-transitory computer readable medium of claim 17, including instructions executable by the processor to:

receive, at the second remote network node, a response from the remote node controller to indicate that the remote node controller has capacity to update the plurality of remote network nodes.