Dhcp agent assisted routing and access control
AssigneeFortinet, Inc.
InventorMathieu Nantel
Life of this patent
Estimating the term…
Abstract
Systems and methods for increasing layer 2 visibility of layer 3 network devices so as to facilitate implementation of device-oriented policy actions by layer 3 network devices are provided. According to one embodiment, unique physical addresses of one or more host devices are retrieved by a dynamic host configuration protocol (DHCP) agent that is operatively coupled with a DHCP server. The physical addresses are mapped to corresponding Internet Protocol (IP) addresses assigned by the DHCP server to the one or more host devices. The mapping is relayed directly or indirectly to a network security device. Network traffic management/security policies are defined within the network security device corresponding to at least one of the unique physical addresses.
Claims18
A method comprising:
- maintaining, by a dynamic host configuration protocol (DHCP) agent running on a server computer system on which a DHCP server is also running, a mapping of Internet Protocol (IP) addresses that have been assigned by the DHCP server to a plurality of host devices of a private network to corresponding unique physical addresses of the plurality of host devices;
- and
- enabling a layer 3 network security device associated with the private network to define and apply network traffic management or security policies to the plurality of host devices based on their respective unique physical addresses by causing, by the DHCP agent, information regarding the mapping to be sent to the layer 3 network security device.
A method comprising:
- maintaining, by a layer 3 network security device protecting a private network, a mapping of Internet Protocol (IP) addresses that have been assigned by a dynamic host configuration protocol (DHCP) server running on a server computer system to a plurality of host devices of the private network to corresponding unique physical addresses of the plurality of host devices by receiving information regarding the mapping directly or indirectly from a DHCP agent running on the server computer system;
- receiving, by the layer 3 network security device, network traffic management or security policies defined with reference to the unique physical addresses of the plurality of host devices;
- and
- enforcing, by the layer 3 network security device, the network traffic management or security policies.
Dependencies are inferred from the claim text.