Unifying Local and Mobility Network Identifiers

CROSS REFERENCE TO RELATED APPLICATIONS

p-0002This Patent Application claims the benefit under 35 U.S.C. §119(e) of U.S. Provisional Patent Application No. 61/178,296 filed on May 14, 2009, entitled, “Method for Unifying Local and Mobility VLAN(s) in a Large Scale Enterprise Network” the contents and teachings of which are hereby incorporated by reference in their entirety.

BACKGROUND

p-0003Personal wireless devices continue to gain increased popularity as mobile devices become smaller and more affordable. Wireless network support, in the form of WiFi access points and more recently, WiMax coverage, continue to drive the demand for wireless bandwidth and corresponding applications. Wireless network support has also infiltrated corporate enterprise networks, as decreasing hardware costs enable the feasibility of wireless coverage in a campus or building environment for a multitude of employees. Therefore, wireless network coverage, just as cellphones emerged initially as a luxury or justified expense for mission critical personnel, is commonly available to a typical consumer or employee. As the relative usage of wireless network access continues to rise in proportion to traditional wired connections offered by stationary devices, the network infrastructure adapts by integrating wireless, or so-called mobility transport, with conventional wired access and switching. Accordingly, unified switches, which combine wired and mobility access and throughput resources in the same network appliance, mitigate the distinction between wired and wireless routers and obviate the need for separate deployment of wireless routers and bridges at specifically chosen network locations deemed worthy of mobility access.

SUMMARY

p-0004In a mobility domain providing wired and wireless network transport to an enterprise or campus environment, unified mobility switches integrate wired and wireless access and switching for users who can employ both stationary and mobile devices for accessing network services from various locations in the mobility domain. Users typically employ a stationary device such as a desktop PC from an office or cubicle, and then may seek access from an alternate location such as a conference room or common area via a laptop, PDA, or other personal communication device, and also tend to roam from location to location using the mobile device.

p-0005Virtual networks are often employed in the mobility domain to facilitate communication with mobile devices. Virtual networks allow grouping of network devices as a common LAN (local area network) independently of the physical location and connections between them. A virtual network such as a VLAN (Virtual Local Area Network) is commonly used in wired enterprise networks to separate broadcast domains. A single broadcast domain typically is mapped to a single IP subnet at Layer 3, thus all devices in the single broadcast domain belong to same IP subnet. VLANs are also employed to apply access control, QOS implementations, and other policies for the users assigned to the VLAN. Since VLAN based policies can be applied at layer 2 (L2) switches, such policies can be applied at line rate to a group of users. Thus, VLANS or other virtual networks are useful for grouping a class of users in the mobility domain. However, the scope of the typical VLAN is bounded by layer 3 (L3) routers. Roaming users spanning an L3 boundary typically become separated from the VLAN. Configurations herein are based, in part, on the observation that VLAN usage in mobility networks results in a disconnect between devices using wired access and devices using wireless access, particularly when the wireless user roams beyond an L3 boundary.

p-0006Unfortunately, conventional methods of supporting roaming network users suffers from the shortcoming that it is difficult to identify a mobile device of a user across various access points that may be employed for wireless network access throughout the mobility domain. Often, a different VLAN is employed for mobility (i.e. wireless) and roaming access than for wired access from a stationary device. Since network policies and IP addresses are tied to a particular wired device corresponding to a user, identification of a mobile device establishing a wireless connection cannot be associated with the user. It would be beneficial to identify a particular user regardless of whether access is made from a stationary or mobile device, and further to maintain connectivity to the user as the user roams among coverage areas corresponding to different access points and mobility switches. Consistent application of network policies and network (IP) addresses is facilitated by consistently identifying a user across various access mediums.

p-0007Accordingly, configurations herein substantially overcome the shortcomings of applying identical policies for both wired and wireless users by mapping a logical network identifier, such as a VLAN ID, to a “home” or wired network VLAN ID so that a mobile device is mapped to the wired VLAN based on user identification and by virtue of this mapping maintain the IP address consistency, and network policy enforcement consistency no matter where the user roams in the mobility domain. Propagation of the mapping to peer mobility switches ensures that a roaming user is mapped to the wired network VLAN from a remote mobility switch, and mobility tunnels across L3 boundaries allow roaming into a different broadcast domain or L3 switch connectivity in the mobility domain.

p-0008In particular, in a wireless enterprise defined by the mobility domain, the users are assigned to mobility VLAN(s) which are mapped to a VLAN in the wired domain at a mobility switch. In effect, the mapping assigns a wired VLAN to the wireless user at a mobility switch. The wireless users can roam within the wireless enterprise, or mobility domain, and the network maintains access to the user assigned mobility VLAN(s).

p-0009In further detail, the method of unifying wired and mobility networks performs a mapping of virtual network identifiers for transporting mobility traffic includes receiving a packet frame from a mobile device, in which the packet frame has a mobility network identifier such as a mobility VLAN. The mobility VLAN is mapped, in a mobility VLAN table at a mobility switch configured for switching both wired message traffic and mobility message traffic, to a wired VLAN network identifier, such that the mobility message traffic is defined by a tunnel to the wireless access point that provides the wireless link to the mobile device and the wired message traffic employs a dedicated wired connection on the mobility switch. The mobility switch determines, from the mapping, the wired VLAN network identifier corresponding to the user of the mobile device, and forwards the packet frame based on the determined wired VLAN network identifier, such that the forwarded packet frame is transported as if it emanated via mapped wired network identifier. Since the wired network identifier is associated with user parameters such as IP address and network policies, the mobility traffic is handled similarly to message traffic from any wired device of the user in the wired VLAN.

p-0010Alternate configurations of the invention include a multiprogramming or multiprocessing computerized device such as a workstation, handheld or laptop computer or dedicated computing device or the like configured with software and/or circuitry (e.g., a processor as summarized above) to process any or all of the method operations disclosed herein as embodiments of the invention. Still other embodiments of the invention include software programs such as a Java Virtual Machine and/or an operating system that can operate alone or in conjunction with each other with a multiprocessing computerized device to perform the method embodiment steps and operations summarized above and disclosed in detail below. One such embodiment comprises a computer program product that has a computer-readable storage medium including computer program logic encoded thereon that, when performed in a multiprocessing computerized device having a coupling of a memory and a processor, programs the processor to perform the operations disclosed herein as embodiments of the invention to carry out data access requests. Such arrangements of the invention are typically provided as software, code and/or other data (e.g., data structures) arranged or encoded on a computer readable medium such as an optical medium (e.g., CD-ROM), floppy or hard disk or other medium such as firmware or microcode in one or more ROM, RAM or PROM chips, field programmable gate arrays (FPGAs) or as an Application Specific Integrated Circuit (ASIC). The software or firmware or other such configurations can be installed onto the computerized device (e.g., during operating system execution or during environment installation) to cause the computerized device to perform the techniques explained herein as embodiments of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

p-0011The foregoing and other objects, features and advantages of the invention will be apparent from the following description of particular embodiments of the invention, as illustrated in the accompanying drawings in which like reference characters refer to the same parts throughout the different views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the invention.

p-0012<figref idrefs="DRAWINGS">FIG. 1</figref> is a context diagram of a mobility domain suitable for use with the present configuration;

p-0013<figref idrefs="DRAWINGS">FIG. 2</figref> is a flowchart of VLAN mapping for unifying local and mobility virtual networks in the mobility domain of <figref idrefs="DRAWINGS">FIG. 1</figref>

p-0014<figref idrefs="DRAWINGS">FIG. 3</figref> is a block diagram of VLAN mapping as in <figref idrefs="DRAWINGS">FIG. 2</figref>

p-0015<figref idrefs="DRAWINGS">FIG. 4</figref> is a diagram of VLAN roaming for a mobile device in the mobility domain of <figref idrefs="DRAWINGS">FIG. 1</figref>; and

p-0016<figref idrefs="DRAWINGS">FIGS. 5-7</figref> are a flowchart of VLAN mapping in the configuration of <figref idrefs="DRAWINGS">FIG. 4</figref>.

DETAILED DESCRIPTION

p-0017Disclosed below is an example configuration of a mobility domain having mobility users employing mobile devices via a mobility VLAN. A mobility VLAN table maps the mobility VLAN to a wired VLAN corresponding to a stationary device of the user, such as a desktop PC in an office. Roaming usage by the user, for example employing a laptop from a remote location such as a lab or conference room, allows the mobility switch to employ the mobility VLAN to identify the wired VLAN for identifying the user.

p-0018Conventional arrangements for coordinating wired and wireless access by the same user include assigning wired users to mobility VLAN(s). One proposed solution for wireless mobility includes locating all wireless VLAN(s) in the core of the network. By tunneling all wireless traffic to the core of the network the system ensures that the wireless users get access to their assigned VLAN from anywhere in the network. In this case no mapping is required and wireless VLAN exists in the core network as wired VLAN.

p-0019One drawback of such a conventional solution is that wireless access and wired access networks are segregated. A user can access the enterprise network using wireless connection or from a wired port. In either case, it is desirable to impose same access policies and assign same IP address. While access policies can be replicated between wired access and wireless access, the approach would not provide for identifying and assigning the same IP address.

p-0020When using virtual network identifiers including VLAN IDs as per IEEE 802.1q, 16 bits are provided for the VLAN field, while the VLAN ID is a 12 bit quantity (0-4095). It is possible to use more than 12-bits for mobility VLAN tagging on tunnels to uniquely identify the mobility VLAN(s) on mobility switches in the domain. However, this non-standard technique may not be available on commercial available switching chipsets and requires a more complicated control plane to manage the uniqueness of the mobility VLAN tag in the mobility domain.

p-0021The disclosed approach, in contrast, maps the mobility VLAN to a local VLAN tag when the traffic ingresses a mobility switch from an access point or a peer mobility switch over a tunnel. It also maps the local VLAN tag back into a mobility domain unique mobility-VLAN tag when the traffic egresses to a peer mobility switch or an access switch. By performing mapping in both ingress and egress, better isolation of the mobility VLAN and local VLAN tag space is achieved.

p-0022<figref idrefs="DRAWINGS">FIG. 1</figref> is a context diagram of a mobility domain suitable for use with the present configuration. Referring to <figref idrefs="DRAWINGS">FIG. 1</figref>, the mobility domain <b>100</b> is an enterprise wide network that typically encompasses a particular site of a corporation or institution, and is analogous to an area traditionally served by a conventional LAN (local area network). In the mobility domain <b>100</b>, a wireless control plane <b>102</b> performs user access and authentication through a wireless controller <b>150</b>. The wireless control plane <b>102</b> therefore admits users to the mobility domain <b>100</b>, in conjunction with the access control server <b>114</b> and access and authentication database <b>116</b>, and also transports control information in the form of configuration, routing table, security and radio access information, shown by arrows <b>122</b>, <b>132</b> and <b>152</b> respectively. Once admitted to the mobility domain (i.e. logging on at a stationary device <b>111</b>, activating a wireless user device <b>110</b>, etc.), a typical user invokes the data plane <b>104</b> for performing message traffic transport. The data plane <b>104</b> performs transport and switching of data to and from the user device <b>110</b>, <b>111</b> using the control information supplied by the control plane <b>102</b> to mobility switches <b>120</b> and access points <b>130</b> using communication links <b>132</b> and <b>122</b> through a fabric of network connections <b>142</b>. The wireless access plane <b>106</b> bridges the wireless gap from the wireless access point <b>130</b> to the user device <b>110</b> using a wireless connection <b>144</b>, and includes modulation and transmission of the data via an RF channel medium, typically according to IEEE 802.11, discussed further below. The wireless access plane <b>106</b> generally provides an overlapping arrangement of coverage areas <b>134</b>-<b>1</b> . . . <b>134</b>-<b>7</b> (<b>134</b> generally) to support seamless roaming. A network management plane <b>108</b> provides centralized storage and coordination of items global to the mobility domain, such as applications <b>112</b>, network access control <b>114</b>, and the access and authentication (AAA) database DB, <b>116</b>. A network management system (NMS) <b>118</b> also provides operator oversight and diagnostic information such as SNMP based inquires.

p-0023In configurations disclosed herein, a virtual network groups devices for communication independently of the physical connections between them. Such a virtual network is identified by a virtual network identifier, discussed further below. The virtual network identifier denotes collection of devices corresponding to a logical LAN configured such that communication is enabled as if they were part of the same wire (LAN). In the disclosed arrangement, a VLAN <b>160</b> (virtual LAN) has the same attributes as a physical LAN, but it allows for network nodes (e.g. switches, mobile devices, stationary endpoints) to be grouped together even if they are not physically located on the same network switch. Network reconfiguration can therefore be performed through software instead of physically relocating devices. In the particular configuration disclosed, the virtual network identifier is a VLAN identifier as defined by IEEE 802.1Q.

p-0024In the mobility domain <b>100</b>, the virtual LANs (VLANs) <b>160</b> provide virtual bridging across a plurality of physical and/or wireless connections <b>142</b> and <b>144</b> to permit roaming from coverage area <b>134</b> to coverage area <b>134</b>-N, as shown by the mobile device <b>110</b> in coverage area <b>134</b>-<b>1</b> moving to coverage area <b>134</b>-<b>2</b> as mobile device <b>110</b>′. The mobility domain <b>100</b> therefore provides mobility connectivity for mobile devices <b>110</b> through wireless switches <b>120</b> and access points <b>130</b>, and also performs wired switching in a mobility backplane <b>140</b> and for fixed devices <b>111</b>, discussed further below. Stationary, or wired devices <b>111</b> are also connected to the core network <b>140</b> through wired connections <b>143</b>, and include user devices <b>111</b> such as PCs and server <b>113</b>, both of which may also be part of a VLAN <b>160</b>.

p-0025<figref idrefs="DRAWINGS">FIG. 2</figref> is a flowchart of VLAN mapping for unifying local and mobility virtual networks in the mobility domain of <figref idrefs="DRAWINGS">FIG. 1</figref>. Referring to <figref idrefs="DRAWINGS">FIGS. 1 and 2</figref>, the method of transporting mobility traffic as disclosed herein includes, at step <b>200</b>, receiving a packet frame <b>115</b> from a mobile device <b>110</b>, and inserting the mobility network identifier <b>182</b> into the received frame <b>115</b>, typically at the access point <b>130</b>, based on mobility network identifier determined at the time of mobility user authentication. A mobility switch <b>120</b>, configured for switching both wired message traffic and mobility message traffic, maps the mobility network identifier in the packet frame <b>115</b> to a wired network identifier, such that the mobility message traffic is defined by a wireless link to the mobile device, as disclosed at step <b>201</b> (mobility traffic generally via wired links, employing a wireless link only for the last “leg” from the access point <b>130</b> to the mobile device <b>110</b>). The virtual network identifier (VLAN ID) is applicable to both wired and mobility devices, although typically a wired “fixed” device corresponding to a user is associated with a different VLAN than a mobile device attributed to the same user, hence the need for associating the VLANs arises. The access point <b>130</b> employs a MAC (Media Access Control) address <b>117</b> associated with the mobile device <b>110</b> to identify the VLAN of the mobile device <b>110</b>. Since the mobile device <b>110</b> may not bear any other identification of the user other than the VLAN ID, the mobility switch <b>120</b> determines, from the mapping, the wired network VLAN identifier <b>184</b> corresponding to the user of the mobile device <b>110</b>, as shown at step <b>202</b>.

p-0026The mobile device's <b>110</b> MAC address <b>117</b> is available in the frame <b>115</b> as received from the wireless device <b>110</b>. The mobility switch <b>120</b> may determine the corresponding mobility VLAN identifier <b>182</b> from frame <b>115</b> based on the source MAC address <b>117</b> in the frame <b>115</b>. In case of full VLAN ID conversion, the AP <b>130</b> inserts the mobility VLAN identifier <b>182</b> before it sends the traffic to the mobility switch <b>120</b> over the access tunnel <b>174</b> (<figref idrefs="DRAWINGS">FIG. 4</figref> below), which derives the mobility VLAN identifier <b>182</b> in the frame <b>115</b> on ingress to the mobility switch <b>120</b>. Alternatively, in partial VLAN ID conversion, the AP <b>130</b> does not insert the identifier tag <b>182</b> and the mobility switch <b>120</b> derives this from the MAC address <b>117</b> of the client mobile device <b>110</b> based on a MAC based VLAN assignment. After the mobility device traffic is mapped to a wired network VLAN identifier <b>184</b>, policies applicable to traffic on the wired network identifier <b>184</b> can be applied to the traffic coming from the mobile devices <b>110</b> for the corresponding VLAN <b>182</b>, thus from the same user <b>170</b>. Thus, the packet frame <b>115</b> from the mobile device <b>110</b> may receive similar treatment as if it emanated from the wired network device <b>111</b> (e.g. desktop PC) of the user. The mobility switch <b>120</b> forwards the packet frame <b>115</b> based on the determined wired network identifier <b>184</b> and the destination device address, such that the forwarded packet frame <b>115</b> is transported via the mapped wired VLAN <b>184</b> to a wired device <b>111</b> such as desktop or PC or to another mobile device <b>110</b> that belongs to the senders mobility VLAN <b>182</b>. When forwarding traffic to a mobile device <b>110</b> the wired network identifier <b>184</b> is converted back into the corresponding mobility network identifier <b>182</b> as determined from the VLAN mapping table <b>180</b>, as depicted at step <b>203</b>.

p-0027<figref idrefs="DRAWINGS">FIG. 3</figref> is a block diagram of VLAN mapping as in <figref idrefs="DRAWINGS">FIG. 2</figref>. Referring to <figref idrefs="DRAWINGS">FIGS. 1 and 3</figref>, <figref idrefs="DRAWINGS">FIG. 3</figref> depicts a mobility scenario of a user <b>170</b>-<b>1</b>, an employee of the engineering department, who typically employs a PC <b>111</b>-<b>1</b> via a wired connection <b>143</b>-<b>1</b>. The PC <b>111</b>-<b>1</b> connects to mobility switch <b>120</b>-<b>1</b>, which provides a core (i.e. wired) network <b>140</b> along with mobility switches <b>120</b>-<b>2</b> and <b>120</b>-<b>3</b>. User <b>170</b>-<b>1</b> also employs a laptop as a mobile device <b>110</b>-<b>1</b> (as user <b>170</b>-<b>1</b>′). The PC <b>111</b>-<b>1</b> is recognized as a wired device belonging to VLAN W<b>1</b>. To support the mobility and roaming scenarios a VLAN mapping table <b>180</b> maps mobility VLAN(s) to wired VLAN(s), thus unifying the mobility network and wired network by providing a similar network identity to a user <b>170</b> accessing the network <b>140</b> via either the wired VLAN identifier <b>184</b> or the mobility VLAN identifier <b>182</b>. The VLAN mapping table <b>180</b> includes fields for the mobility VLAN <b>182</b>, the corresponding wired (i.e. stationary device or non-mobility) VLAN <b>184</b>, a name <b>186</b> of the VLAN, and an index <b>188</b> for each VLAN entry, discussed further below.

p-0028The VLAN mapping table <b>180</b> is a configuration item or download that is arranged according to preassigned VLANs and network identities (i.e. IP addresses of fixed devices <b>111</b>). An administrator configures the supported mobility VLAN(s) in the mobility domain at the mobility controller <b>150</b> using unique names typically identified by group or organization. The mobility controller <b>150</b> generates a mobility VLAN name to a mobility VLAN ID mapping <b>153</b> and propagates this mapping table to all mobility switches in the mobility domain directly managed by the mobility controller <b>150</b> and to peer mobility controllers <b>150</b>-N which then forward it to the mobility switches <b>120</b>-N managed by them. Thus all mobility switches <b>120</b> in the mobility domain receive the table of supported mobility VLAN(s) and the mobility VLAN ID <b>153</b> assigned to the names <b>186</b>.

p-0029The administrator also configures the mapping between the mobility VLAN name <b>186</b> and a wired VLAN ID <b>184</b> on one or more mobility switches <b>120</b> in the mobility domain that have direct physical access to the desired wired VLAN <b>184</b> for a particular corresponding mobility VLAN <b>182</b>, as reflected in the mobility VLAN table <b>180</b>, mirroring the named VLAN mapping <b>153</b> in the mobility controller <b>150</b>. The mapping between mobility VLAN <b>182</b> and wired VLAN <b>184</b> unifies the wireless devices <b>110</b> on the mobility VLAN with the wired devices <b>111</b> on the wired VLAN into a single broadcast domain, and thus enables a mobility user to access the domain <b>100</b> from a mobility device <b>110</b> as if they were connecting via their wired (fixed) device <b>111</b>, such as an office PC, and receive similar network identity via a common policy and IP address.

p-0030In the example shown, user <b>170</b>-<b>1</b> sends a message to user <b>170</b>-<b>2</b>, at mobile device <b>110</b>-<b>2</b>, from the wired device <b>111</b>-<b>1</b> as shown by arrow <b>172</b>-<b>1</b>. Some time later, user <b>170</b>-<b>1</b> access via a mobile device <b>110</b>-<b>1</b> (as user <b>170</b>-<b>1</b>′) and receives a reply message <b>172</b>-<b>2</b> to mobile device <b>110</b>-<b>1</b> corresponding to stationary device <b>111</b>-<b>1</b>. A subsequent reply <b>172</b>-<b>3</b> from user <b>170</b>-<b>1</b>′ is transported to VLAN M<b>20</b>, corresponding to VLAN W<b>2</b>, from entry <b>190</b>-<b>2</b>, which denotes user <b>170</b>-<b>2</b> for purposes of IP address identification and network policy administration. The wired device of VLAN W<b>2</b> for user <b>170</b>-<b>1</b> may also be local to the core network <b>140</b>, or it may be roaming from another L2 network, discussed in <figref idrefs="DRAWINGS">FIG. 4</figref> below.

p-0031The unification of the wired VLAN(s) with the mobility VLAN(s) is provided by the VLAN mapping table <b>180</b>, and by propagating the table to switches <b>120</b> in the mobility domain <b>100</b>, maintains access to a mobile user's mobility VLAN <b>182</b> from all locations (typically defined by access points <b>130</b>) in the mobility domain <b>100</b>, thus ensuring that the mobile user <b>170</b> maintains access to the mapped wired VLAN <b>184</b> via a mobile device <b>110</b>. Typically, in a wired network a wired VLAN maps to an IP subnet, as is known in the art. A particular feature of the mobility VLAN mapping <b>180</b> is that a mobile device <b>110</b> can maintain the IP address assigned to it since its IP subnet does not change as it roams in the mobility domain <b>100</b>. A second feature is that the access rights and policies that are applied on the wired VLAN <b>184</b> are also applied to the traffic from the wireless users. For example, the switches <b>120</b> in the wired VLAN may implement an access policy that allows access to only certain servers in the wired VLAN. If a user logs in as a wired user using PC <b>111</b>-<b>1</b> then the switches can limit this access accordingly. When the same user logs in as a wireless user using a laptop from another location in the enterprise, the mapping <b>180</b> allows enforcement of the same access policy on the user <b>170</b> as the from the wired device <b>111</b>. The policy is therefore tied to the user and not on the access location. This can be achieved if users are assigned to mobility VLAN(s) based on their login credentials and the mobility VLAN is mapped to a single wired VLAN in the mobility domain. In this case, the mobility traffic is switched at the mobility switches <b>120</b> that enforce a common access policy for wired as well as wireless users.

p-0032While VLAN IDs are typically recognized only among an L2 domain, L3 boundaries may be traversed by the VLAN mapping disclosed herein. L3 mobility can be provided using the mobile IP feature at layer 3, as described in RFC 3344 and RFC 3775. The Mobile IP solution has the burden of using more than one IP address per device (Care-of address and home address), therefore the send and receive paths of bi-directional flow from a mobile device can be different and the implementation may be driven by the version of IP being used.

p-0033<figref idrefs="DRAWINGS">FIG. 4</figref> is a diagram of VLAN roaming for a mobile device <b>110</b> in the mobility domain of <figref idrefs="DRAWINGS">FIG. 1</figref>. Referring to <figref idrefs="DRAWINGS">FIG. 4</figref>, mobility switches <b>120</b>-<b>11</b> and <b>120</b>-<b>13</b> (SW<b>1</b> and SW<b>3</b>) are servers for VLANr (<b>160</b>-<b>10</b>). It should be noted that virtual LANs are primarily layer 2 constructs, compared with IP subnets which are layer 3 constructs, thus giving rise to mapping across L3 boundaries via tunnels. Mobility switch <b>120</b>-<b>12</b> (SW<b>2</b>) connects via an L3 connection <b>190</b>, thus defining L3 boundary <b>192</b>. Mobile user <b>110</b>-<b>12</b> corresponds to wired user <b>110</b>-<b>11</b>, as shown by the mapping of MUr<b>1</b> to VLANr <b>160</b>-<b>10</b> in the VLAN mapping table <b>180</b>. Access points <b>130</b>-<b>11</b>.<b>130</b>-<b>13</b> connect to mobility switches SW<b>1</b> and SW<b>2</b> via access tunnels <b>174</b>-<b>1</b>.<b>174</b>-<b>3</b>. The access tunnels <b>174</b>-<b>1</b>.<b>174</b>-<b>3</b> (<b>174</b> generally) provide a transport for wireless frames from the access point <b>130</b> to the switching infrastructure of the core network <b>140</b>. The access tunnels <b>174</b> therefore allow VLAN recognition through the L3 connection <b>190</b>, thus effectively bridging L2 networks. Similarly, a mobility tunnel <b>196</b> effectively bridges the L3 boundary <b>192</b> by extending a VLAN <b>160</b> from one network (SW<b>1</b>, SW<b>3</b>) to another (SW<b>2</b>) to provide remote access to the remote VLAN for roaming. User <b>110</b>-<b>12</b> is afforded L2 mobility by access points <b>130</b>-<b>11</b> . . . <b>130</b>-<b>13</b> because of direct access to SW<b>1</b> or SW<b>2</b> via L2 connectivity, as the VLAN visibility extends throughout the L2 network. The mobility tunnel <b>196</b> therefore extends VLANr to SW<b>3</b>, thereby providing L3 roaming capability if user <b>110</b>-<b>12</b> roams to a coverage area <b>134</b> of access point AP<b>4</b> (via mobility tunnel <b>196</b> and access tunnel <b>174</b>-<b>4</b>), shown as user <b>110</b>-<b>12</b>′.

p-0034The access points <b>130</b> employ a mapping of MAC address to VLAN, IP address, or other suitable indexing to correlate the wireless link <b>144</b> to the corresponding tunnel <b>174</b> or connection <b>142</b>. The mobile devices <b>110</b> typically have a preassigned MAC address, and are allocated to a default or “home” VLAN by a predetermined assignment stored at the mobility controller and employed for defining the VLAN mapping table <b>180</b>, as described above. From a VLAN perspective, the VLAN mapping ends at the access point where mapping an 802.11 wireless packet completes the transport.

p-0035In general, the MAC address of the user's mobile device <b>110</b> will control the mapping back to the “home” (i.e. wired) VLAN. Thus, a consistent MAC address would be needed in order to “transfer” a session from device to device, as opposed to roaming (as in with a laptop) or remote login (setting up a session). For example, such a device transition might be performed if the user uses a device that can be connected using a wired access or wireless access and it uses same MAC address on both interfaces. One scenario this may work is if a laptop is initially connected using wired access and it is undocked and it immediately connects using wireless access and it uses the same MAC address for communication on wireless access as it used on wired access. In this scenario, since the user gets access to the same VLAN and uses the same MAC address, he may be able to continue the communication with small glitch. This is an additional benefit of the invention provided the client device supports the capability of using same MAC address on wired/wireless interface.

p-0036<figref idrefs="DRAWINGS">FIGS. 5-7</figref> are a flowchart of VLAN mapping in the configuration of <figref idrefs="DRAWINGS">FIG. 4</figref>. Referring to FIGS. <b>1</b> and <b>3</b>-<b>7</b>, at step <b>300</b>, in the example configuration, the mobility controller <b>150</b> generates a mapping of mobility network identifiers <b>182</b> to users <b>170</b> such that the mobility network identifier <b>182</b> is indicative of a virtual local area network (VLAN). The VLAN has a visibility within a broadcast domain defined by L2 (layer 2) switches, is identified by a unique name <b>186</b> in the mobility domain <b>100</b> for administrative convenience. Policy definitions use the VLAN name. As part of initialization and startup, the mobility controller <b>150</b> generates or receives a 12-bit mobility VLAN tag for each mobility VLAN defined by the administrator.

p-0037This includes determining, for each user <b>170</b>, the wired network identifier <b>184</b> indicative of the stationary device <b>111</b>, as shown at step <b>301</b>. The mobility controller <b>150</b> assigns the wired network identifier <b>184</b> to the stationary device <b>111</b> corresponding to the user <b>170</b>, in which the stationary device <b>111</b> is defined by a wired connection <b>143</b> to the core network <b>140</b>, and the mobility device <b>110</b> is defined by a wireless link <b>144</b> to the core network <b>140</b>, as disclosed at step <b>302</b>. The wired network identifier <b>184</b>, in effect, provides the network identity of the user <b>170</b> because the wired network identifier <b>184</b> defines network policies and an IP address corresponding to the stationary device. The defined network policies and IP address may be attributed to the packet frames <b>115</b> mapped to the wired network identifier <b>184</b> from the mobility network identifier <b>182</b>, as depicted at step <b>303</b>.

p-0038In addition to the wired network identifier <b>184</b>, the mobility controller <b>150</b> also assigns a mobility network identifier <b>182</b> to a mobility device <b>110</b> corresponding to a user <b>170</b>, as shown at step <b>304</b>. A network administrator can then enable remote service of the mobility VLAN on a mobility switch <b>120</b>. The mobility switch <b>120</b> will advertise this service to peer mobility switches <b>120</b>. When a mobility switch <b>120</b> is not configured to terminate traffic from access switches locally, it will tunnel the traffic to a peer mobility <b>120</b> switch that advertises a member server for the mobility VLAN (mobility network identifier <b>182</b>). Enabling remote service on a mobility VLAN enables L3 mobility for users assigned to the mobility VLAN.

p-0039However, there is not yet a correlation from the mobility VLAN <b>182</b> to the stationary device (e.g. wired network VLAN <b>184</b>) to identify the user <b>170</b> when operating/connecting via the mobility VLAN <b>182</b>. Therefore, at step <b>305</b>, the mobility controller then defines a mapping, stored as the mobility VLAN table <b>180</b>, from the mobility network identifier <b>182</b> to the wired network identifier <b>184</b>, in which the mapping <b>180</b> determines the wired network identifier <b>184</b> corresponding to a packet frame <b>115</b> emanating from the mobility device <b>110</b> assigned to the mobility network identifier <b>182</b>. Accordingly, the mobility domain <b>100</b> stores the mapping <b>180</b> at a wireless controller (mobility controller <b>150</b>), in which the wireless controller (WC) is coupled to each of the mobility switches <b>120</b> for transporting the mapping, as disclosed at step <b>306</b>.

p-0040When the mobility controller <b>150</b> distributes the mobility VLAN table <b>180</b> to each of the mobility switches <b>120</b>, any of the mobility switches <b>120</b> may translate the mobility VLAN identifier <b>182</b> to a local VLAN identifier <b>184</b> (tag) for switching upon receiving traffic from an access switch or a peer mobility switch. When the traffic is released locally at the mobility switch <b>120</b>, it carries the local VLAN tags <b>184</b>. Accordingly, the mobility controller <b>150</b> provides the generated mapping <b>180</b> across an L3(layer 3) boundary <b>192</b>, in which the provided mapping <b>180</b> is for associating the mobility network identifier <b>182</b> with the wired network identifier <b>184</b> at a mobility switch <b>120</b> outside the L2 visibility of the VLAN, as depicted at step <b>307</b>. In the example configuration, the core network <b>140</b> includes a plurality of mobility switches <b>120</b>, such that the mobility switches are unified for transport of wired and wireless switching by maintaining the copy of the mobility VLAN table <b>180</b>, as shown at step <b>308</b>.

p-0041In the operation of transporting mobility traffic, a mobility switch <b>120</b> receives a packet frame <b>115</b> from a mobile device <b>110</b>, such that the packet frame <b>115</b> has a mobility network identifier <b>182</b>, as depicted at step <b>309</b>. In the example mobility domain <b>100</b>, embodying wireless transport under IEEE 802.11, the mobility switch <b>120</b> receives a packet frame <b>115</b> for forwarding, the packet frame <b>115</b> including framing according to at least one of a wired framing protocol and a wireless framing protocol, the wired framing corresponding to IEEE 802.3 and the wireless framing corresponding to 802.11, as disclosed at step <b>310</b>. In a typical exchange with an access point <b>130</b>, the access point receives the packet frame <b>115</b> as an 802.11 packet from the mobile device <b>110</b>, and converts the packet frame <b>115</b> to an 802.3 packet for wired transport, framing the 802.3 packet as a UDP/IP frame, and tunnels the UDP/IP frame in an outer 802.3 framing across an L3 boundary via an access tunnel <b>174</b>, as depicted at step <b>311</b>.

p-0042The access point <b>130</b> thus maps the wireless frames <b>115</b> into a mobility VLAN tagged 802.3 frame based on a MAC address to mobility VLAN mapping (note that this is an 802.11 to 802.3 mapping at the access point <b>130</b>, prior to encountering the VLAN mapping table <b>180</b>). The access point <b>130</b> therefore sends, via access tunnel <b>174</b>, the mobility VLAN tagged frames to a mobility switch <b>120</b>. In general, the access traffic is transmitted from wired/wireless user from an attached access switch (access point <b>130</b>) to a mobility switch <b>120</b>. In case of wireless users, the access switch is the wireless access point <b>130</b> and it uses tunnels to transfer mobility VLAN tagged L2 frames to the mobility switch <b>120</b>. Wireless users <b>170</b> are assigned to mobility VLAN(s) when they authenticate with the access network via access control <b>114</b>.

p-0043A check is performed to identify a roaming user, meaning that a user <b>170</b> is accessing an access point <b>130</b> outside the L2 domain afforded by their native wired VLAN <b>184</b>. If the check determines that a recipient of the packet frame is a roaming user serviced by a remote mobility switch, at step <b>312</b>, then a remote mobility switch <b>120</b> is receiving a packet frame <b>115</b> from the mobile device <b>110</b>, in which the remote mobility switch <b>120</b> is indicative of a roaming user, as depicted at step <b>313</b>. This includes receiving a packet frame <b>115</b> from a user <b>170</b> at the L3 switch, such that the user is a roaming user <b>170</b> having a mobile device <b>110</b> in communication with a remote mobility switch <b>120</b>, the remote mobility switch being in a separate broadcast domain by an intervening L3 switch <b>190</b>, as depicted at step <b>313</b>.

p-0044When a mobile user <b>170</b> employs an access point <b>130</b> served by a mobility switch <b>120</b> in the same L2 domain, the mobility VLAN table <b>160</b> at that mobility switch <b>120</b> has visibility of both the wired VLAN <b>184</b> and the mobility VLAN <b>182</b>. However, if the user <b>170</b> roams beyond an L3 boundary, a mobility tunnel <b>196</b> is established to bridge the L3 boundary. Accordingly, at step <b>315</b>, the mobility switch <b>120</b>-<b>11</b> establishes a mobility tunnel <b>196</b> to the remote mobility switch <b>120</b>-<b>12</b>. This includes identifying, via the mapping <b>180</b>, the mobility network identifier <b>182</b> at a mobility switch <b>120</b>-<b>12</b> different than the mobility switch <b>120</b>-<b>11</b> included in the wired connection of the stationary device <b>110</b>-<b>11</b> to the core network <b>140</b>, as disclosed at step <b>316</b>.

p-0045In both the roaming (L3 boundary) and non-roaming cases, the mobility switch <b>120</b> indexes, from the mapping <b>180</b>, the mobility network identifier <b>182</b> to determine the wired network identifier <b>184</b> corresponding to the user <b>170</b>, as depicted at step <b>317</b>. The mobility switch <b>120</b>-<b>11</b> corresponding to the wired device <b>110</b>-<b>11</b> thus maps a VLAN ID defined by the mobility network identifier <b>182</b> to a wired network identifier <b>184</b> denoting a wired VLAN <b>160</b>-<b>10</b>, as disclosed at step <b>318</b>. In the example unified network disclosed, this includes mapping, at a mobility switch <b>120</b>-<b>11</b> configured for routing wired message traffic and mobility message traffic, the mobility network identifier <b>182</b> to a wired network identifier <b>184</b>, in which the mobility message traffic is defined by a wireless link <b>144</b> to the mobile device <b>110</b>, as clarified at step <b>319</b>. Such a unified network integrates wired and wireless routing information in the mobility switches <b>120</b>.

p-0046In the example VALN arrangement, he mobility network identifier <b>182</b> and the wired network identifier <b>184</b> are virtual network identifiers (VLANs), such that the virtual network identifiers define a plurality of network conversant devices independent of physical connections between the network conversant devices, as disclosed at step <b>320</b>. Thus, the mobility network identifier <b>182</b> has a visibility among mobility switches <b>120</b> in a local area network (LAN) corresponding to the stationary device <b>110</b>-<b>11</b>, in which the core network <b>140</b> includes a plurality of LANs such as that defined by mobility switches <b>120</b>-<b>12</b> and <b>120</b>-<b>13</b>, as shown at step <b>321</b>.

p-0047From the mapping, the mobility switch <b>120</b> determines the wired network identifier <b>184</b> corresponding to the user <b>170</b> of the mobile device <b>110</b>, as depicted at step <b>322</b>. As indicated above, the network identity of the user <b>170</b>, such as IP address and network policies, are denoted by the VLAN corresponding to the wired network device <b>110</b>-<b>11</b>. Therefore, users <b>170</b> employ network resources according to their assigned wired VALN ID <b>184</b>, promoting consistent application of access policies and IP address. The mobility switch <b>120</b> then forwards the packet frame based on the determined wired network identifier, the packet frame <b>115</b>, in which the forwarded packet frame <b>115</b> is transported via the mapped wired network identifier <b>184</b> that denotes the mobile user <b>170</b>, as depicted at step <b>323</b>. The forwarding decision by the mobility switch <b>120</b> thus forwards the packet frame <b>115</b> on a port corresponding to the mapped VLAN <b>184</b>, as disclosed at step <b>324</b>.

p-0048In network appliances (switches) having an older architecture, VLAN recognition may employ configuration tuning. Recalling that the maximum size for an Ethernet frame as specified by IEEE 802.3 is 1518 bytes, this means that if a maximum-sized Ethernet frame gets tagged, the frame size will be 1522 bytes, a number that violates the IEEE 802.3 standard. To resolve this issue, the 802.3 committee created a subgroup called 802.3 ac to extend the maximum Ethernet size to 1522 bytes. Some network devices that do not support a larger frame size will process the frame successfully but may report these anomalies

p-0049In a particular configuration, if the administrator ensures that the mobility VLAN is mapped to only one wired VLAN in the domain, the disclosed mapping ensures that the wireless user gets access to same wired VLAN from all locations in the enterprise. When QoS and security policies are also associated with the wired VLAN this ensures that the network applies same policies to the user no matter where he/she connects from.

p-0050In an alternate configuration, the administrator may define a mapping of a mobility VLAN to multiple wired VLAN(s) at different mobility switches in the enterprise. In fact for certain types of mobility VLAN(s) it might be done intentionally. For example, a mobility VLAN for guest users can be mapped to different wired VLAN in different branches of the enterprise to localize the guest traffic within a branch.

p-0051Such a configuration may also be extended to wired users. By assigning wired users to mobility-VLAN they get the similar roaming capability. For example, laptops can be connected using wireless or wired medium for any location in the enterprise and the invention will ensure identical network service except for the service differences that may arise due to differences in nature of wireless/wired medium.

p-0052Some switching chip vendors may not support conversion of VLAN tags at ingress on the mobility switch. When such chips are used for mobility switches we can achieve conversion in ingress using source MAX based local-VLAN tag assignment on the ingress.

p-0053When there is no mapping configured on mobility switch between mobility-VLAN and local VLAN the traffic cannot be release locally on the mobility switch. In this case the mobility switch selects a peer mobility switch as the server of the mobility VLAN and assigns a temporary unused local VLAN tag for the mobility VLAN. This temporary local VLAN tag is used for switching decisions with the mobility switch.

p-0054Those skilled in the art should readily appreciate that the programs and methods for mapping local and mobility (wireless) virtual network identifiers as defined herein are deliverable to a user processing and rendering device in many forms, including but not limited to a) information permanently stored on non-writeable storage media such as ROM devices, b) information alterably stored on writeable storage media such as floppy disks, magnetic tapes, CDs, RAM devices, and other magnetic and optical media, or c) information conveyed to a computer through communication media, as in an electronic network such as the Internet or telephone modem lines. The operations and methods may be implemented in a software executable object or as a set of encoded instructions for execution by a processor responsive to the instructions. Alternatively, the operations and methods disclosed herein may be embodied in whole or in part using hardware components, such as Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), state machines, controllers or other hardware components or devices, or a combination of hardware, software, and firmware components.

p-0055While the system and method for mapping local and mobility virtual network identifiers has been particularly shown and described with references to embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the invention encompassed by the appended claims.