Policy-based processing of packets

A method for processing packets based on a policy identifying a non-network address first group identifier corresponding to a first group and a non-network address second group identifier corresponding to a second group, the first group including a first user and a second user, and the second group including a first server;

• the method comprising:
• a first packet switching device receiving the policy;
• a second packet switching device receiving the policy;
• the first packet switching device receiving a first plurality of packets from the first user and processing the first plurality of packets based on the policy to control access to the first server;
• and
• the second packet switching device receiving a second plurality of packets from the second user and processing the second plurality of packets based on the policy to control access to the first server.

A method for processing packets based on a policy identifying a non-network address first group identifier corresponding to a first group and a non-network address second group identifier corresponding to a second group, the first group including a first user and a second user, and the second group including a first server and a second server;

• the method comprising:
• a first packet switching device receiving the policy;
• a second packet switching device receiving the policy;
• the first packet switching device receiving a first plurality of packets from the first user and processing the first plurality of packets based on the policy to control access to the first server;
• and
• the second packet switching device receiving a second plurality of packets from the second user and processing the second plurality of packets based on the policy to control access to the second server.

A method for processing packets by a packet switching device, the method comprising:

• authenticating a user using 802.1x protocol with a server and in response, receiving a non-network address user group identifier corresponding to said authenticated user from the server;
• and
• for each particular packet of a plurality of packets received from the user:
• performing a lookup based on a non-source address field of the plurality packet to identify a second non-network address identifier, and performing a lookup operation on a policy based on the non-network address user group identifier and the second non-network address identifier to identify a packet processing action to be performed on said particular packet.

An apparatus for processing a packet, the apparatus comprising:

• input interface circuitry configured to receive the packet, the packet including a source address field and a second field;
• a source user group association mechanism configured to associate a non-network address user source group identifier with the packet;
• a group lookup mechanism configured to identify a second non-network address group identifier based on the second field;
• and
• a policy lookup mechanism configured to perform a lookup operation on a policy based on the non-network address user group identifier and the second non-network address identifier to identify a packet processing action to be performed on said particular packet.

An apparatus for processing packets, the apparatus comprising:

• means for authenticating a user;
• means for receiving a non-network address user group identifier corresponding to said authenticated user;
• means for receiving one or more policies associated with the non-network address user group identifier;
• means for receiving a packet and associating the non-network address user group identifier with said received packet, the received packet including a source address and a second field;
• means for identifying a second non-network address group identifier based on the second field;
• and
• means for performing a lookup operation on a policy based on the non-network address user group identifier and the second non-network address group identifier to identify a packet processing action to be performed on said received packet.