# US 12,113,770 B2 · DHCP snooping with host mobility > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,770 B2 - Document ID: US12113770B2 - Status: Granted - Kind: B2 - Application number: 16/737,607 - Filed: 2020-01-08 - Published: 2021-07-08 - Granted: 2024-10-08 - Earliest claimed: 2020-01-08 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Manoj Pandey; Samir Thoria; Ali Sajassi - Web page: https://patentgrep.com/patent/US12113770B2 ## CPC - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 45/021: Ensuring consistency of routing table updates, e.g. by using epoch numbers - H04L 45/028: Dynamic adaptation of the update intervals, e.g. event-triggered updates - H04L 45/66: {Layer 2 routing, e.g. in Ethernet based MAN's} - H04L 45/74: Address processing for routing - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L 61/5053: Lease time; Renewal aspects - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract This disclosure describes methods of operating a leaf node device, such as a switch device, connected to a switch fabric of a network. The leaf node device receives, from another leaf node device via the switch fabric, an indication of a secure route to a host device. In response to receiving the indication of the secure route, the leaf node device creates or updates a routing entry for the host device in a routing information base of the leaf node device and creates or updates an entry for the host device in a Dynamic Host Configuration Protocol (DHCP) snoop database of the leaf node device. The leaf node may thereby communicate with the host device that is attached to the leaf node device as a result of moving from the other leaf node device. ## Claims ### Claim 1 A method of operating a first leaf node device connected to a switch fabric, comprising: receiving, at the first leaf node device and from a second leaf node device, a Border Gateway Protocol (BGP) update message including an advertisement of a route from the switch fabric to a host device using an Internet Protocol (IP) to Media Access Control (MAC) pairing, wherein the first leaf node device includes a first Dynamic Host Configuration Protocol (DHCP) snoop database and the second leaf node device includes a second DHCP snoop database storing an indication that the route from the switch fabric to the host device is authenticated as secure; determining, at the first leaf node device, that the BGP update message includes a BGP Extended Community attribute that is populated with a value that indicates the IP-to-MAC pairing is valid and the route from the switch fabric and to the host device is authenticated as secure; by the first leaf node device, in response to determining that the BGP update message includes the value that indicates the IP-to-MAC pairing is valid and the route to the host device is secure, creating or updating an entry indicating the route for the host device in the first DHCP snoop database of the first leaf node device; and based at least in part on the entry in the first DHCP snoop database, enabling, by the first leaf node device, secure data traffic from the host device prior to the host device otherwise communicating with the first leaf node device to make the first leaf node device aware that the host device is connected to the first leaf node device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: by the first leaf node device, determining from the first DHCP snoop database of the first leaf node device that the route to the host device is secure and, based at least in part on the determining, communicating with the host device attached to the first leaf node device. ### Claim 3 (depends on 1) The method of claim 1, wherein the switch fabric is an underlay for an Ethernet Virtual Private Network (EVPN) overlay. ### Claim 4 (depends on 1) The method of claim 1, further comprising: by the first leaf node device, receiving from the second leaf node device, via the switch fabric, an indication of a lease renewal time for the route, wherein creating or updating the entry for the host device in the first DHCP snoop database includes providing the lease renewal time in the entry. ### Claim 5 (depends on 1) The method of claim 1, wherein updating the entry for the host device in the first DHCP snoop database includes updating a lease expiration time for the host device in the entry. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving an address resolution protocol (ARP) message from the host device; caching the ARP message; and validating the cached ARP message at least in part using the entry for the host device in the first DHCP snoop database of the first leaf node device. ### Claim 7 (depends on 1) The method of claim 1, wherein the BGP update message includes a BGP Extended Community attribute that is populated with a value that indicates the route is authenticated as secure. ### Claim 8 A first leaf node device, comprising: one or more processors; and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations of: receiving, from a second leaf node device, via a switch fabric, a Border Gateway Protocol (BGP) update message including an advertisement of a route from the switch fabric to a host device using an Internet Protocol (IP) to Media Access Control (MAC) pairing, wherein the first leaf node device includes a first Dynamic Host Configuration Protocol (DHCP) snoop database and the second leaf node device includes a second DHCP snoop database storing an indication that the route from the switch fabric to the host device is authenticated as secure; determining that the BGP update message includes data that indicates the IP-to-MAC pairing is valid and the route from the switch fabric and to the host device is authenticated as secure; in response to determining that the BGP message includes the data that indicates the IP-to-MAC pairing is valid and the route to the host device is secure, creating or updating an entry indicating the route for the host device in the first DHCP snoop database of the first leaf node device; and based at least in part on the entry in the first DHCP snoop database, enabling, by the first leaf node device, secure data traffic from the host device prior to the host device otherwise communicating with the first leaf node device to make the first leaf node device aware that the host device is connected to the first leaf node device. ### Claim 9 (depends on 8) The first leaf node device of claim 8, wherein the switch fabric is an underlay for an Ethernet Virtual Private Network (EVPN) overlay. ### Claim 10 (depends on 8) The first leaf node device of claim 8, the operations further comprising: receiving from the second leaf node device, via the switch fabric, an indication of a lease renewal time for the route, wherein creating or updating the entry for the host device in the first DHCP snoop database includes providing the lease renewal time in the entry. ### Claim 11 (depends on 8) The first leaf node device of claim 8, wherein updating the entry for the host device in the first DHCP snoop database includes updating a lease expiration time for the host device in the entry. ### Claim 12 (depends on 11) The first leaf node device of claim 11 further comprising transmitting to other leaf node devices in the switch fabric the updated lease expiration time for the host device using a BGP Extended Community attribute. ### Claim 13 (depends on 8) The first leaf node device of claim 8, the operations further comprising: receiving an address resolution protocol (ARP) message from the host device; caching the ARP message; and validating the cached ARP message at least in part using the entry for the host device in the first DHCP snoop database of the first leaf node device. ### Claim 14 (depends on 8) The first leaf node device of claim 8, wherein the BGP update message includes a BGP Extended Community attribute that is populated with a value that indicates the route is authenticated as secure. ### Claim 15 One or more non-transitory computer-readable storage media storing computer-readable instructions that, when executed, instruct a processing unit of a first leaf node device connected to a switch fabric to perform operations comprising: receiving, at the first leaf node device and from a second leaf node device, a Border Gateway Protocol (BGP) update message including an advertisement of a route from the switch fabric to a host device using an Internet Protocol (IP) to Media Access Control (MAC) pairing, wherein the first leaf node device includes a first Dynamic Host Protocol Configuration (DHCP) snoop database and the second leaf node device includes a second DHCP snoop database storing an indication that the route from the switch fabric to the host device is authenticated as secure; determining, at the first leaf node device, that the BGP update message includes data that indicates the IP-to-MAC pairing is valid and the route from the switch fabric and to the host device is authenticated as secure; in response to determining that the BGP update message includes the data that indicates the IP-to-MAC pairing is valid and the route to the host device is secure, creating or updating an entry indicating the route for the host device in the first DHCP snoop database of the first leaf node device; and based at least in part on the entry in the first DHCP snoop database, enabling, by the first leaf node device, secure data traffic from the host device prior to the host device otherwise communicating with the first leaf node device to make the first leaf node device aware that the host device is connected to the first leaf node device. ### Claim 16 (depends on 15) The one or more non-transitory computer-readable storage media of claim 15, wherein the operations further comprise: receiving from the second leaf node device, via the switch fabric, an indication of a lease renewal time for the route, wherein creating or updating the entry for the host device in the first DHCP snoop database includes providing the lease renewal time in the entry. ### Claim 17 (depends on 15) The one or more non-transitory computer-readable storage media of claim 15, wherein updating the entry for the host device in the first DHCP snoop database includes updating a lease expiration time for the host device in the entry. ### Claim 18 (depends on 15) The one or more non-transitory computer-readable storage media of claim 15, the operations further comprising: receiving an address resolution protocol (ARP) message from the host device; caching the ARP message; and validating the cached ARP message at least in part using the entry for the host device in the first DHCP snoop database of the first leaf node device. ### Claim 19 (depends on 15) The one or more non-transitory computer-readable storage media of claim 15, wherein the switch fabric is an underlay for an Ethernet Virtual Private Network (EVPN) overlay. ### Claim 20 (depends on 15) The one or more non-transitory computer-readable storage media of claim 15, wherein the BGP update message includes a BGP Extended Community attribute that is populated with a value that indicates the route is authenticated as secure.