Link-layer authentication for legacy network nodes using a remote network access server

A method comprising:

• receiving, via a remote tunnel receiver module at a remote network access server (“NAS”) a link layer authentication packet from a remote NAS agent running on an edge network access node connected to a client, the link layer authentication packet received from a tunnel terminator of a tunneling connection between the remote NAS and the remote NAS agent running on the edge network access node;
• transmitting the link layer authentication packet to an authentication server as part of a link layer authorization process;
• receiving a link layer authentication packet from the authentication server;
• and
• transmitting, via a remote tunnel transmitter module, the link layer authentication packet received from the authentication server to the edge network access node via the tunneling connection,
• wherein in response to exchanging link layer authentication packets resulting in authorization of the client by the authentication server, the edge network access node authorizes the client for network access through the edge network access node,
• wherein the edge network access node comprises an application programming interface (“API”) that allows the remote NAS to control at least some functionality of the edge network access node and the edge network access node is incapable of running a link layer authorization process without the remote NAS agent.

A program product for a remote network access server (“NAS”) agent comprising a non-transitory computer readable storage medium and program code, the program code being configured to be executable by a processor to perform operations comprising:

• receiving, at an edge network access node and over a local area network (“LAN”), a link layer authentication packet from a client using a remote network access server (“NAS”) agent running on the edge network access node, the link layer authentication packet indicating that the client is seeking network access through the edge network access node;
• transmitting, with a tunnel transmitter module and over a network different from the LAN, the link layer authentication packet to a remote NAS for processing in a link layer authentication process, wherein the link layer authentication packet is transmitted to the remote NAS using a tunneling connection, wherein the link layer authentication process exchanges the link layer authentication packet with an authentication server to authenticate the client;
• receiving, with a tunnel receiver module, a link layer authentication packet from the remote NAS over the tunneling connection, the received link layer authentication packet comprising a response from the authentication server regarding the transmitted link layer authentication packet;
• transmitting the received link layer authentication packet to the client;
• and
• in response to exchanging link layer authentication packets resulting in authorization of the client, authorizing, with a client authorization module, the client for network access through the edge network access node,
• wherein the edge network access node comprises an application programming interface (“API”) that allows the remote NAS to control at least some functionality of the edge network access node and the edge network access node is incapable of running a link layer authorization process without the remote NAS agent.