Efficient Hardware Resource Utilization for 802.1X Authentication
AssigneeArista Networks, Inc.
InventorsBasil Saji, Krishna S, Vishal Bandekar, Milind Kulkarni, Pratishtha Panwar
Life of this patent
Estimating the term…
Abstract
Techniques for implementing 802.1X authentication in a manner that optimizes hardware resource usage on authenticator devices are provided. In certain embodiments, these techniques reduce the number of ternary content-addressable memory (TCAM) rules that are programmed for unauthenticated hosts in an authenticator device from O(N) to O(1), where N is the number of interfaces on the authentication device that have 802.1X authentication enabled.
Claims20
A method performed by a network device, the method comprising:
- receiving a data packet on an interface of the network device;
- upon determining that the interface is configured with 802.1X authentication and has both Extensible Authentication Protocol-based authentication (EAP) and Media Access Control-based authentication (MBA) enabled, tagging the data packet with a first label;
- and
- upon determining that the interface is configured with 802.1X authentication and has only Extensible Authentication Protocol-based authentication (EAP) enabled, tagging the data packet with a second label different from the first label.
A network device comprising:
- a processor;
- a ternary content-addressable memory (TCAM);
- a plurality of interfaces;
- and
- a memory have stored thereon program code that, when executed by the processor, causes the processor to:
- receive a data packet on an interface in the plurality of interfaces;
- upon determining that the interface is configured with 802.1X authentication and has both Extensible Authentication Protocol-based authentication (EAP) and Media Access Control-based authentication (MBA) enabled, tag the data packet with a first label;
- and
- upon determining that the interface is configured with 802.1X authentication and has only Extensible Authentication Protocol-based authentication (EAP) enabled, tag the data packet with a second label different from the first label.
A method performed by a network device, the method comprising:
- for each set of TCAM banks that is mapped to a packet processing engine of the network device:
- programming a first TCAM rule into the set of TCAM banks, the first TCAM rule including a first match key that matches on a first label and a first action that traps matched packets to a central processing unit (CPU) of the network device, the first label being associated with data packets that are received by the network device from unauthenticated hosts on an 802.1X-configured interface with both Extensible Authentication Protocol-based authentication (EAP) and Media Access Control-based authentication (MBA) enabled;
- and
- programming a second TCAM rule into the set of TCAM banks, the second TCAM rule including a second match key that matches on a second label and a second action that drops matched packets, the second label being associated with data packets that are received by the network device from unauthenticated hosts on an 802.1X-configured interface with only EAP enabled.
Dependencies are inferred from the claim text.