System and method for port mapping in a communications network switch

PRIORITY UNDER 35 U.S.C. §119(e) & 37 C.F.R. §1.78

This nonprovisional application claims priority based upon the following prior United States provisional patent application entitled: “PORT MAPPING WITH USER/NETWORK PORTS,” Application No. 60/721,670, filed on Sep. 29, 2005, in the names of: Subash Bohra, Vincent Magret, and Steve Valentine which is hereby incorporated by reference.

1. Technical Field of the Invention

The present invention generally relates to communications networks. More particularly, and not by way of any limitation, the present invention is directed to system and method for port mapping in switches of such networks.

2. Description of Related Art

In the past, it has been common communications network engineering practice to separate traffic belonging to different users using a router, which is a Layer 3 (“L3”) device by assigning each user to a different subnet identified by a unique L3 address. The router would then transmit each user's packets out through a port assigned to the user's subnet. In view of the fact that only a limited number of bits in the L3 address are used for the subnet mask, the number of subnets that may be addressed by a single router is limited.

It will be recognized that in a communications network, there are many users of the network who require that their traffic be kept absolutely separate from the traffic of other users. For example, an Internet service provider (“ISP”) will typically have many customers who want to connect to a server farm. Access to the ISP is through a router connected to a common external computer network, such as the Internet. This router must route each customer's traffic to that customer's local area network (“LAN”) in such a manner as to maintain security and privacy between the data of different customers. It is imperative that the ISP prevent traffic originating from one customer's server from being received by another customer's server. As previously indicated, a limitation in the use of subnets in this scenario is that there is only a limited number of subnets which can be defined from standard Layer 3 addresses. In modern computer network systems, this numerical limitation severely restricts the number of individual users that can be serviced and also have their data traffic maintained separately. Further, the management of a large number of subnets by a network manager quickly becomes burdensome, especially in the event that the network has thousands of customers whose packet traffic must be kept separate.

Another means by which users traffic may be kept separate is through use private Virtual Local Area Networks (VLANs) defined within a network switch, or bridge, which is a Layer 2 (“L2”) device. A private VLAN is a VLAN feature in which access ports of a switch are allowed to communicate only with certain designated router ports. The security implementation with a Private VLAN is conducted at the hardware layer and does not allow for any frame of any sort to pass between adjacent access ports within a Private VLAN. Private VLANs provide port-based security and isolation between ports within the assigned VLAN. Data traffic on downlink ports can only be forwarded to, and from, uplink ports. A deficiency of private VLANs is that they can be difficult to configure and may not provide a complete solution in some cases.

One embodiment is a method of implementing a port mapping technique in a switch of a communications network, wherein the switch includes a plurality of ports including user ports and network ports. The method comprises identifying a first portion of the ports as user ports; identifying a second portion of the ports as network ports; assigning a plurality of the user ports to a first session; and preventing user ports assigned to the first session from interacting with one another.

Another embodiment is a method of implementing a port mapping technique in a switch of a communications network, wherein the switch includes a plurality of ports. The method comprises identifying a first portion of the ports as user ports; identifying a second portion of the ports as network ports; assigning a plurality of the user ports to a first session; preventing user ports assigned to the first session from interacting with one another; and permitting the user ports assigned to the first session to interact with ports not assigned to the first session as long as none of the network ports is assigned to the first session.

Another embodiment is a system for implementing a port mapping technique in a switch of a communications network, wherein the switch includes user ports for connecting to user devices and network ports for connecting to network devices. The system comprises means for assigning a plurality of the user ports to a first session; and means for preventing user ports assigned to the first session from interacting with one another.

A more complete understanding of the present invention may be had by reference to the following Detailed Description when taken in conjunction with the accompanying drawings wherein:

FIG. 1 is a block diagram of a switch in which a port mapping technique in accordance with one embodiment is implemented;

FIG. 2 is a block diagram of a switch in which a port mapping technique in accordance with one embodiment is implemented;

FIG. 3 is a block diagram of a communications network in which a port mapping technique in accordance with one embodiment is implemented;

FIG. 4 is a block diagram of a communications network in which a port mapping technique in accordance with one embodiment is implemented;

FIG. 5 is a block diagram of a communications network in which a port mapping technique in accordance with one embodiment is implemented;

FIG. 6 is a block diagram of a communications network in which a port mapping technique in accordance with one embodiment is implemented;

FIG. 7 is a flowchart of the operation of a port mapping technique in accordance with one embodiment for configuring a switch; and

FIGS. 8A and 8B illustrate port bitmap tables for respective switches of a network in which a port mapping technique in accordance with one embodiment is implemented.

Embodiments of the invention will now be described with reference to various examples of how the invention can best be made and used. Like reference numerals are used throughout the description and several views of the drawings to indicate like or corresponding parts, wherein the various elements are not necessarily drawn to scale.

As will be described in detail hereinbelow, one embodiment is a system and method for port mapping in a communications network switch. In particular, the embodiments described herein distinguish between network ports (i.e., ports that connect a switch to other switches in a network) and user ports (i.e., ports to which user devices are connected to the switch) in connection with a port mapping session, identified by a session ID assigned to the port. In general, when only one side (i.e., user ports) of a session is created on a switch, the user ports of that session can communicate with any other ports on the switch, but not with each other. This situation is illustrated in FIG. 1 . In particular, as shown in FIG. 1 , two sessions (Session 1 and Session 2 ) are created on a switch 100 . Session 1 user ports 102 are ports 1 - 2 . Session 2 user ports 104 are ports 3 - 4 . The remaining ports 5 - 26 are general ports 106 . Because no network ports have been created for either Session 1 or Session 2 , the Session 1 user ports 102 can communicate with the Session 2 user ports 104 and the general ports 106 on the switch 100 . Similarly, the Session 2 user ports 104 can communicate with the Session 1 user ports 102 and the general port 106 on the switch 100 . However, the Session 1 user ports 102 (ports 1 and 2 ) cannot communicate with one another; similarly, the Session 2 user ports 104 (ports 3 and 4 ) cannot communicate with one another. The general ports 106 (ports 5 - 26 ), on the other hand, are not similarly restricted and can communicate with one another.

When two sides (i.e., user ports and network ports) of a session are created on a single switch, the user ports in the session can communicate only with the network ports in the same session and with no other ports on the switch. The session thus forms a closed entity on the switch with respect to the user ports. This situation is illustrated in FIG. 2 .

In particular, as shown in FIG. 2 , two sessions (Session 1 and Session 2 ) are created on a switch 200 . Session 1 user ports 202 are ports 1 - 2 . Session 1 network ports 204 are ports 25 - 26 . Session 2 user ports 206 are ports 3 - 4 . The remaining ports 5 - 24 are general ports 208 . Because network ports 204 have been created for Session 1 , the Session 1 user ports 202 can communicate only with the Session 1 network ports 204 . In contrast, the Session 2 user ports 206 can communicate with the Session 1 network ports 204 and with the general ports 208 on the switch 200 . Once again, however, the Session 1 user ports 202 (ports 1 and 2 ) cannot communicate with one another; similarly, the Session 2 user ports 206 (ports 3 and 4 ) cannot communicate with one another. The network ports 204 and the general ports 208 (ports 5 - 26 ), on the other hand, are not similarly restricted and can communicate with one another.

In general, for user and network ports, the following rules are applied by the embodiments described herein for implementing port mapping using network and user ports.

1. A port mapping session comprises a session ID, a set of user ports, and/or a set of network ports. 2. A port mapping session can be configured with or without user ports and network ports. 3. User ports with a common session ID cannot communicate with each other. 4. A user port can be part of only one port mapping session at any time. 5. A user port cannot be a network port and vice versa. 6. If a set of network ports of a given session is non-empty, then any user ports of the same session can only communicate with members of that set of network ports. 7. If a session is configured as “bidirectional”, the network ports of that session cannot communicate with other network ports of the same session.

The “closure” referred to above is primarily provided by rule 6, which prevents user ports from communicating with other ports in the system.

Application of the above-listed rules will now be illustrated in greater detail with reference to FIGS. 3-4 . In particular, FIG. 3 illustrates a port mapping among four switches S 1 -S 4 in a network 100 in accordance with one embodiment. The switch S 1 has a plurality of user ports A, B, and M 1 -M 3 , as well as a plurality of network ports N 1 -N 3 . Similarly, the switch S 2 has user ports C, D, and Y, and a network port N 4 . The switch S 3 has user ports E, F, and X and a network port N 5 , and the switch S 4 has user ports G, H, and Z, and a network port N 7 . It will be assumed for the sake of example, that the following port mapping sessions have been configured on the network 100 as illustrated in FIG. 3 .

On Switch S 1 :

Port Mapping Session 1 (Session ID=1): ports A and B are user ports; ports N 1 and N 2 are network ports configured in bidirectional mode

Port Mapping Session 2 (Session ID=2): ports M 1 , M 2 , and M 3 are user ports, port N 3 is a network port

On Switch S 2 :

Port Mapping Session 1 (Session ID=1): ports G and H are user ports, port N 7 is a network port

Based on the configuration shown in FIG. 3 and described above, the following is attained:

1. User ports A and B cannot interact with one another (because they have the same session ID); 2. User ports A and B cannot interact with ports on the switch S 2 (because they can only communicate with network ports N 1 (to switch S 3 ) and N 2 (to switch S 4 ); 3. User ports C, D, and Y can interact with all user ports on the network except user ports A and B on the switch S 1 (for the same reasons as set forth above); 4. User ports G and H cannot interact with each other (because they have the same session ID); 5. User ports G and H can interact with all the user ports on the switch S 1 except user ports M 1 , M 2 , and M 3 , but cannot interact with any port on the switch S 3 (network port N 7 (switch S 4 ) is connected to network port N 2 (switch S 1 ), which is session ID 1 and therefore communicates with user ports A and B, but not M 1 , M 2 , and M 3 ; network ports N 1 and N 2 cannot communicate with one another due to bidirectional session); and 6. User ports E, F, and X can interact with all of the user ports on the switch S 1 except the user ports M 1 , M 2 , and M 3 , but cannot interact with any port on the switch S 4 (same reason as above).

Referring now to FIG. 4 , it will be assumed for the sake of example, that the following port mapping sessions have been configured on the network 100 as illustrated in FIG. 4 .

On Switch S 1

Port Mapping Session 1 (Session ID=1): ports A and B are user ports; ports N 1 and N 2 are network ports configured in unidirectional mode.

Port Mapping Session 2 (Session ID=2): ports M 1 , M 2 , and M 3 are user ports; port N 3 is a network port.

On Switch S 4

Port Mapping Session 1 (Session ID=1): ports G and H are user ports, port N 7 is a network port.

Based on the foregoing configuration illustrated in FIG. 4 and described above, the following is attained:

1. User ports A and B cannot interact with one another (because they have the same session ID); 2. User ports A and B cannot interact with ports on the switch S 2 (because they can only communicate with network ports N 1 (to switch S 3 ) and N 2 (to switch S 4 ); 3. User ports C, D, and Y can interact with all user ports on the network except user ports A and B on the switch S 1 (for the same reasons as set forth above); 4. User ports G and H cannot interact with each other (because they have the same session ID); 5. User ports G and H can interact with all the user ports on the switch S 1 except user ports M 1 , M 2 , and M 3 (network port N 7 (switch S 4 ) is connected to network port N 2 (switch S 1 ), which is session ID 1 and therefore communicates with user ports A and B, but not M 1 , M 2 , and M 3 ) and can interact with any port on switch S 2 or switch S 3 (network ports N 1 and N 2 can communicate with each other due to unidirectional session); and 6. User ports E, F, and X can interact with all of the user ports on the switch S 1 except the user ports M 1 , M 2 , and M 3 and can interact with any port on the switch S 2 or the switch S 3 (same reason as above).

It will be recognized that if network ports N 1 , N 2 , and N 3 are made part of both of the sessions on the switch S 1 (i.e., sessions 1 and 2 ), which is configurable, then the ports N 1 , N 2 , and N 3 will be able to interact with each other and the user ports C, D and Y on the switch S 2 will be able to interact with all of the user ports on the switches S 1 , S 3 , and S 4 .

Referring now to FIG. 5 , it will be assumed for the sake of example, that the following port mapping sessions have been configured on the network 100 as illustrated in FIG. 5 .

On Switch 1 :

Port Mapping Session 1 (Session ID=1): ports N 1 and N 2 are network ports configured in bidirectional mode.

Port Mapping Session 2 (Session ID=2): port N 3 is a network port.

On Switch 4 :

Port Mapping Session 1 (Session ID=1): ports G and H are user ports.

Based on the foregoing, the following situation is attained:

1. User ports A, B, M 1 , M 2 , and M 3 can interact with one another (all are general ports with no session ID); 2. The only restriction on the switch S 1 is that network ports N 1 and N 2 cannot interact with one another (bidirectional session), thus restricting switches S 3 and S 4 from communicating with one another; 3. User ports G and H on switch S 4 cannot interact with one another (ports G and H have the same session ID) and cannot interact with ports on the switch S 3 (due to inability of network ports N 1 and N 2 to interact with one another).

Referring now to FIG. 6 , it will be assumed for the sake of example, that the following port mapping sessions have been configured on the network 100 as illustrated in FIG. 6 .

On Switch S 1 :

Port Mapping Session 1 (Session ID=1): ports A and B are user ports.

Port Mapping Session 2 (Session ID=2): ports M 1 , M 2 , and M 3 are user ports.

On Switch S 4 :

Port Mapping Session 1 (Session ID=1): ports G and H are user ports.

Based on the forgoing, the following situation is attained:

1. User ports A and B cannot interact with one another (same session ID). 2. User ports M 1 , M 2 , and M 3 cannot interact with one another (same session ID). 3. User port A can interact with user ports M 1 , M 2 , and M 3 , and vice versa (different session IDs and no network port assigned to session). 4. User port B can interact with user ports M 1 , M 2 , and M 3 , and vice versa (same as above). 5. User ports G and H cannot interact with one another (same session ID).

FIG. 7 is a flowchart of the operation of the embodiments described herein for configuring a switch for implementation of port mapping using network and user ports. In step 700 , a network administrator identifies all user ports on the switch that should not be permitted to interact with any other user port on the switch and assigns a first session ID to those user ports. In step 702 , the network administrator identifies network ports with which the user ports identified in step 700 are permitted to interact and assigns the first session ID to those network ports. As a result, the only ports on the switch with which the user ports identified in step 700 are able to interact are the network ports identified in step 702 .

In step 704 , the network administrator identifies user ports on the switch that should not be permitted to interact with one another and assigns a second session ID to those user ports. Step 704 may be repeated for any number of groups of user ports that are not to be permitted to interact with one another, but are permitted to interact with user ports of other sessions, general ports, and network ports.

In one embodiment, the rules are implemented by establishing the allowed ports by bitmap tables within generally available application specific integrated circuits (“ASICs”) in the switches. The configuration is managed so that the desired behavior is attained. For example, on one ASIC, when a packet is received at a port, the switch decides to which port to transmit the packet. In one embodiment, the corresponding entry in the port bitmap table that allows for transmit is set to zero for restricted ports and to one for allowed ports.

FIGS. 8A and 8B illustrate exemplary bitmap tables for the ports of the switches S 1 and S 4 , respectively, of FIG. 3 when those switches are configured as illustrated in that figure. A one in an entry indicates that interaction is allowed between the corresponding ports; a zero indicates that interaction is not allowed. For example, as illustrated in FIG. 8A , interaction is not allowed between user ports A and B, as indicated by a zero in the corresponding entries for those ports, while interaction is allowed between user port A and network port N 1 , as indicated by a one in the corresponding entries for those ports.

It is believed that the operation and construction of the present invention will be apparent from the Detailed Description set forth above. While the exemplary embodiments of the invention shown and described have been characterized as being preferred, it should be readily understood that various changes and modifications could be made therein without departing from the scope of the present invention as set forth in the following claims.