Platform independent implementation of private VLANS

[0001] 1. Field of the Invention

[0002] Then present invention relates to virtual local area networks, VLAN's, and more particularly to private VLAN's or PVLAN's.

[0003] 2. Background Information

[0004] Virtual local area networks (VLAN's) represents a broadcast domain, where a client can send frames to any other client in the same VLAN. However, this arrangement presents security issues where other clients can monitor the traffic in the VLAN. Private VLAN's (PVLAN's) were invented to address this security issue.

[0005] Several prior U.S. patents, discussed below, describe the environment of the present invention.

[0006] U.S. Pat. No. 5,394,402, issued on Feb. 28, 1995 to Ross ('402). This patent is hereby incorporated herein by reference. This patent discloses that physical ports of a particular switch may be associated with groups within the switch by creating a table associating the ports with a VLAN designation. The VLAN designation and associated switch ports may be used in headers to direct messages sent to or received from any ports assigned to the VLAN designation. A memory is provided to store these associations that are usually in the form of tables.

[0007] Typically, the switch is a computer with one or more CPU's, memory and input/output (I/O) cards. Each card may include a limited number of ports that couple the switch to the other network entities over various types of media, such as Ethernet, FDDI (Fiber Distributed Data Interface) or token ring connections. A last hop or edge switch (or router) sends and receives messages, typically frames, to and from end users (Clients) over a communication network, e.g. the Internet. The edge switch typically contains an operating system, a route information base (RIB), a forwarding information base (FIB) and a management information base (MIB), hereinafter collectively referred to as an “information base,” that allows the switch to receive and forward messages regardless of the end user protocol.

[0008] U.S. Pat. No. 5,959,989 ('989) issued Sep. 28, 1999 and is commonly owned with the present invention and is hereby incorporated herein by reference. This patent describes an invention for multicast distribution in VLAN's. Port addresses are associated with VLAN designations and with MAC (Media Access Control) addresses that are then arranged in groups for distribution. MAC addresses are typically hardwired in network interface cards (NIC).

[0009] The above references further describe VLAN's where a port is configured in one VLAN only, and where a port in one VLAN does not send traffic to a port in another VLAN. The following discussion introduces PVLAN's, where a port receives and/or sends information via at least two different but related VLAN's.

[0010] U.S. Pat. No. 6,741,592 ('592), issued May 25, 2004 and is commonly owned with the present application. The '592 patent is hereby incorporated herein by reference. This patent describes PVLAN's as three related VLAN's defined within a layer 2 (L2) switch. The three VLAN's are defined as one primary, one isolated and/or multiple community VLAN's. The isolated and community VLAN's collectively are referred to herein as secondary VLAN's. PVLAN's introduce three related ports, defined, respectively, as promiscuous, isolated and community. The promiscuous ports are connected to layer 3 (L3) or layer 4 (L4) devices, for example, routers that may in turn connect to the Internet or administrative work station or common net work servers, e.g. a Dynamic Host Configuration Protocol (DHCP) server. The isolated and community ports connect to individual users' computers or servers, etc. and carry traffic for those users.

[0011] A primary VLAN functionally connects the promiscuous ports with isolated or community ports. The primary VLAN receives packets from L3/L4 devices at the promiscuous ports and transfers the packets to the isolated or community ports. The packets travel only one way from the promiscuous ports to the ports in the secondary VLAN's.

[0012] An isolated VLAN is defined as a VLAN that functionally connects isolated ports to promiscuous ports. In an isolated VLAN the traffic is only one way—packets are received at an isolated port and travel only from that isolated port to a promiscuous port. Packets are not available to other isolated or community ports.

[0013] A community VLAN is defined as a VLAN that functionally connects community ports to promiscuous ports. In a community VLAN the traffic is only one way—packets are received at a community port and travel only from that community port to the promiscuous ports and to the other community ports on that community VLAN. Packets do not travel from a community port to isolated ports, or to community ports on a different community VLAN that may exist on the same switch.

[0014] Assignment tables and/or Color Blocking Logic (CBL) logic circuits, found within L2 switches that support PVLAN's, are used in known embodiments of the logic operations, described above, in a PVLAN among the promiscuous, isolated and community ports and the primary, isolated and community VLAN's. Such tables and logic are referenced in the '592 patent and are known to those skilled in the art. But, such logic implementations are specific to particular hardware platforms.

[0015] A network security issue is discussed in an article entitled, “Capturing Network Traffic for the Catalyst 6000 IDS Module,” issued by Cisco Press on Feb. 15, 2002. This article is hereby incorporated herein by reference.

[0016] The article describes VLAN access control lists (VACL's) for directing communication traffic flow to specific physical switch ports. The VACL's capture traffic in both directions—inbound and outbound from a port on the switch. The Catalyst 6000 IDS Module is a physical printed circuit interface card, and, as such, initialization of VACL's on the physical card requires creating/storing of the VACL's within a data structure (table) mapping the VACL's to specific VLAN's, and defining a VACL capturing port. The Catalyst 6000 IDS Module may have ports configured as Switched Port Analyzer (SPAN) ports that can direct traffic from ports to specific VLAN's or destination ports. However, in either case the physical configuration to implement these operations is intimately tied to the physical hardware and not easily transferred to other platforms.

[0017] When configuring a VLAN within an L2 switch using known techniques, an administrator will manually designate ports within the VLAN. However, when configuring PVLAN's, the administrator defines a primary and one or more secondary VLAN's but the MAC addresses associated with the corresponding ports are learned only in the primary VLAN. Learning MAC addresses associated with ports typically occurs dynamically as messages are received at the ports, using, for example, an address resolution protocol (ARP).

[0018] In an L2 switch configured to support PVLAN's, a forwarding engine operating with respect to a primary VLAN stores the MAC addresses and port numbers for the users connected to the ports. The MAC addresses of users that are also assigned to secondary VLAN's are not learned in that secondary VLAN. This alters the normal MAC address learning mechanism of typical VLAN's, requiring the PVLAN implementation to be closely tied to the hardware implementation. The above discussed CBL is implemented to effect the transfer of messages between proper ports via the restricted (isolated/community/primary traffic restrictions) and one-way traffic nature of a PVLAN.

[0019] Specifically, when a packet is received at an isolated or community port, the receiving port number is used to index into a table where the secondary VLAN designation is found. The packet is transferred to the forwarding engine for that secondary VLAN, and the destination port number from the packet is used to index another table defined for outgoing traffic from the primary VLAN. The L3/L4 destination address and promiscuous port number are retrieved from the table, and the packet is transferred to the forwarding engine associated with the primary VLAN that directs the packet to the proper L3/L4 device. As noted above, these known implementations are closely tied to the physical hardware in the L2 switch and not easily transferred to other platforms.

[0020] Typically, a user on a secondary VLAN is unaware of (cannot “see,” is a term of art meaning that there is no reference available to that secondary VLAN) other users on another VLAN. So, a port on one secondary VLAN cannot send traffic directly to a port of the primary VLAN.

[0021] The present invention is directed to relieving to the above limitations and untying the PVLAN's from specific hardware platforms.

[0022] The present invention is directed to a method and apparatus that learns information of devices connected to the port in a primary or secondary VLAN associated with a PVLAN. MAC addresses may be learned in either a primary VLAN or in a secondary VLAN but such information is made available, preferably by replication, in the secondary or primary VLAN where the learning did not occur. Here the information learned includes port number and MAC address, but other useful information (depending on the application) may be learned in the PVLAN.

[0023] MAC addresses are learned in VLAN's configured in L2 switches, as known in the art, but the replication of the MAC addresses in both the primary and secondary VLAN's has the advantage of the PVLAN being implemented on generic L2 switches without any assumptions on the hardware platform. Address resolution protocol messages are received at a switch port designated in a VLAN. The switch creates an information base (for example a table, a linked list, stack or other storage structure) containing the MAC address sending the message, the receiving port number, and the associated VLAN designations. Such MAC addresses may be learned in either the primary or the secondary VLAN's, and the present invention makes the information available, by, in a preferred embodiment, replicating the information in the corresponding VLAN's in the PVLAN.

[0024] The present invention provides a system where a receiving packet is directed to a destination port that may belong to another VLAN within the PVLAN. The present invention also provides a system whereby if the sender and the receiver are in the same isolated VLAN, then communication is blocked for security reasons.

[0025] In another preferred embodiment, the information may be placed or stored in one location but accessible to all the VLAN's within a PVLAN.

[0026] It will be appreciated by those skilled in the art that although the following Detailed Description will proceed with reference being made to illustrative embodiments, the drawings, and methods of use, the present invention is not intended to be limited to these embodiments and methods of use. Rather, the present invention is of broad scope and is intended to be defined as only set forth in the accompanying claims.

[0034] FIG. 1 is a general schematic/block diagram of a private VLAN (PVLAN) network. Here the layer 2 switch includes a CPU, related RAM, ROM and mass storage memory and I/O capabilities along with operational software. The switch may be implemented in combinations of hardware (ASIC's), firmware and software as applications suggest.

[0035] As discussed above, a private VLAN (PVLAN) network may be built within a L2 switch 102 where promiscuous ports, isolated ports and community ports are defined. These ports taken together are configured to define a primary VLAN and secondary VLAN's. A primary VLAN carries messages in one direction only from promiscuous ports to isolated or community ports. An isolated VLAN carries messages in one direction only from isolated ports to promiscuous ports, and a community VLAN caries messages in one direction only from community ports to promiscuous ports and to other community ports on the same community VLAN. Isolated VLAN's and/or community VLAN's are referenced herein as secondary VLAN's.

[0036] The L2 switch 102 has promiscuous ports, A, B, and others up to N, where “N” is an arbitrary number. In addition, the L2 switch 102 has community or isolated ports #1, #2 up to #M, where M is an arbitrary number. These ports are designated, by the system administrator, as isolated or community ports. The isolated/community ports connect to end users' servers 122, 126 up to 132, as shown.

[0037] The promiscuous ports A, B, . . . N connect to layer 3 or layer 4 devices 140,143,146. Examples of layer 3 or layer 4 devices are routers, common network servers, like DHCP servers, work stations, back-up network devices, etc. An administrative work station is a work station where a network administrator may view all, or at least many, of the details and occurrences on the network. Typically the administrator configures the promiscuous, community and isolated ports into the primary and secondary VLAN's. In this example, promiscuous Port A connects to layer 3 or layer 4 device (L3/L4 device) 140 that functionally connects to network cloud 142. Promiscuous ports B connects to device 143 that functionally connects to the network cloud 144. Device 146 is a representative network server—a DHCP device that is functionally connected to promiscuous port N.

[0038] Network clouds 142, 144 may be different network clouds, for example each may comprise a backup device for a particular user server. Alternatively, each network cloud 142, 144 may represent the worldwide Internet. Further, each network cloud may represent one or several particular devices, and may also represent the worldwide Internet, etc.

[0039] FIG. 2 is a block/schematic diagram of the interior of the L2 switch configured in accordance with the present invention. The L2 switch has an operating system 202 that monitors and controls, inter alia, the operation of the switch and, with a PVLAN manager 204, the PVLAN operation of the switch. A MAC address table (MAC ADD TABLE 1) resides in the operating system. This table contains the MAC addresses associated with all the ports and VLAN modules that comprise a PVLAN. The VLAN modules include a primary VLAN module 240, an isolated VLAN module 242 and a community VLAN module 244. There are MAC address tables, MAC ADD tables P, I and C, arranged in hardware memories, one in each VLAN module, that function as forwarding tables primarily controlled by the PVLAN manager 204.

[0040] The operating system, PVLAN manager and VLAN modules are generally software operating with hardware memories. But, these modules may be formed in software, firmware, and hardware and combination thereof.

[0041] With the PVLAN manager 204, the primary VLAN P module 240 carries out the primary VLAN operations, the VLAN I module 242 carries out the isolated VLAN operations, and the VLAN C module 244 carries out the community VLAN operations. Corresponding MAC ADD. TABLE's P, I and C contain the forwarding information base needed to transfer packets between ports, as described below.

[0042] In this example, the L2 switch has a series of ports that operate as promiscuous ports 232, a series of ports that operate as isolated ports 234, and a series of ports that operate as community ports 236. Not shown, the community ports may be formed into subgroups of community ports.

[0043] FIG. 3 illustrates one example embodying the invention for forming the forwarding MAC address tables. First, the administrator designates 300 the port types (promiscuous, isolated, community) and assigned them to the primary VLAN and to a corresponding secondary VLAN, either isolated or community. Note each isolated and community port is assigned to two VLAN's, and the promiscuous ports will be assigned to the primary and all the secondary VLAN's. This information is stored 302 in the operating system MAC ADD TABLE 1 and in the tables associated with the primary and the secondary VLAN'S.

[0044] A MAC address is learned 304 at a port in a secondary VLAN. As mentioned before, this may be accomplished via the known address resolution protocols (ARP). For example, if a user is connected to port 1 of a switch, and that port is assigned to secondary VLAN, then the MAC address, say MAC 1, of the user server is learned by receiving a message from that server. The learned MAC address and VLAN designations are transferred 306 to the operating system and stored in MAC ADD TABLE 1, and the new entry is replicated 308 in the primary VLAN by the PVLAN module.

[0045] In a similar manner all the ports and their connected client MAC addresses are learned and replicated in the tables associated with the primary and secondary VLAN's. For example, if the MAC address is learned a port on the primary VLAN 310, the learned MAC address and the receiving port number are sent to the operating system and stored in the MAC ADD TABLE P 312. The new entry is sent to secondary VLAN's and stored in the MAC ADD TABLES I and C 314.

[0046] With respect to a particular port in the PVLAN, FIG. 4 illustrates the contents in the MAC ADD TABLE 1 in the operating system 202, and MAC ADD TABLE P in the primary VLAN 240 and in MAC ADD TABLE I or C in the secondary VLAN 242 or 244. In FIG. 4, item 402 is the MAC address of the user on a secondary VLAN port, and item 404 is the port address and item 406 is the VLAN designation of either the primary or secondary VLAN.

[0047] Regardless of where or how information of a port in a secondary VLAN is determined, the present invention provides for the L2 switch's software to replicate the learned information, preferably, in a table within the operating system and in the primary VLAN. Similarly, address learned in the primary VLAN are replicated in the secondary VLAN's. In such a manner all the users on all the ports of the primary and all the secondary VLAN's are referenced within the corresponding secondary and primary VLAN's and in the operating system.

[0048] As mentioned above, prior PVLAN implementations are tied closely to specific platforms where dynamic learning of addresses of devices connected to ports occurs only in the primary VLAN's. In the present invention, these limitations are overcome by using any generic L2 switch configured to implement a PVLAN in accordance with the present invention. In particular, some L2 switch implementations use the Spanning Tree Protocol (STP) that prevents traffic flow between ports of different VLAN's, but the present invention provides an L2 switch that allows traffic from secondary VLAN ports to pass through primary VLAN ports, and visa-versa. This is so because the ports are configured in both VLAN's and the MAC addresses learned are replicated in the other corresponding VLAN's. However, it is necessary that the ports in the two VLAN's be in synch. For example, if the port in the primary VLAN is in the forwarding state, the state of that port in the secondary VLAN must also be in the forwarding state. That is the state of these ports must be updated to be consistent in both VLAN's.

[0049] FIG. 5 is a generic packet format within the L2 switch. The VLAN designation 502 is in concert with the port designations (promiscuous, isolated, or community) that received the packet. The MAC address 504 of the destination, the source MAC address and port address 506, the data being transferred 510, and other fields 512 in the underlying packet (checksum/CRC, etc.) follow. It is understood that many other packet organizations may be used within the context of the present invention.

[0050] FIG. 6 illustrates a flow chart of the traffic flow of a particular packet within a switch configured in accordance with the present invention. A packet is received 600 at a port that is identified to port type and associated with a VLAN 602. The packet is tagged with the VLAN 604, and is handled by the corresponding VLAN module in concert with the PVLAN manager. The destination MAC address is found from the packet 608, and the used to index into forwarding table (MAC ADD TABLE) 610. Although the destination MAC address may be in another VLAN within the PVLAN, the replication technique discussed in this invention makes the destination MAC address present in the above referenced forwarding table. The associated destination port number is retrieved 612, and packet is transferred 614 to that port for delivery. The VLAN's and the PVLAN manager carry out the PVLAN protocol needed for delivering the packet. In this illustration, the logic ensuring the transfer of packets according to the PVLAN is still in effect. The specific VLAN's will still operate, as described, to allow only the limited one way traffic characteristic of PVLAN's. Note, the VLAN designation attached to the packet is functional only within the VLAN, so any such designation is removed once the packet exits the VLAN.

[0051] Packets received by at an isolated port 234 (FIG. 2) are tagged with the isolated VLAN designation, VLAN I, and functional control of the packets is transferred to the PVLAN manager and the VLAN I module. The destination MAC address is retrieved from the packet itself. That destination MAC address is used to index into MAC ADD TABLE I to find and deliver the packet to the destination promiscuous port. Again the transfer is one way only from the isolated port to the promiscuous port.

[0052] Packets received at a promiscuous port 232 (FIG. 2) are tagged with the promiscuous VLAN designation, VLAN P, and functional control of the packets is transferred to the PVLAN manager and the VLAN P module. The destination MAC address is retrieved from the packet itself. That destination MAC address is used to index into MAC ADD TABLE P to find and deliver the packet to the destination isolated or community port. Again the transfer is one way only from the promiscuous port to the isolated or community port.

[0053] Packets that received at a community port are tagged VLANC1. Functional control of the packets is transferred to the PVLAN manager and the VLANC1 module. The destination MAC address is retrieved from the packet itself. That destination MAC address is used to index into the associated MAC ADD TABLE C to find and deliver the packet to the destination promiscuous port. The PVLAN manager also delivers the packet to any other community port designated as part of the same community VLAN. Community ports may be arranged as multiple sub-groups of community ports where packets are shared among those community ports in a sub-group. In such an instance the tagging will incorporate a particular sub-group. For example, if the sub-groups were designated A, B, and C, the tags would then read VLANCA1 for sub-group A, VLANCB1 for sub-group B and VLANCC1 for sub-group C. Other tagging arrangements will be known to those skilled in the art.

[0054] As known to those skilled in the art and as mentioned above, other data storage structures, including one table, linked lists, stacks may be used to advantage in some applications, and further the information may be included in logic modules without a formal table or data structure being developed. These and other such techniques will be known to those skilled in the art.

[0055] It should be understood that above-described embodiments are being presented herein as examples and that many variations and alternatives thereof are possible. Accordingly, the present invention should be viewed broadly as being defined only as set forth in the hereinafter appended claims.