Establishing connectivity in networks

A method for creating one or more connectivity groups in a network which comprises a plurality of domains, wherein each network station can have a first type address and a second type address, wherein traffic within each of said domains is delivered using first type addresses of destination network stations without using second type addresses of destination network stations, but between domains traffic is transferred using the second type addresses of destination network stations, the method comprising:

• (1) for each domain D1 of at least two of said domains, a computer system obtaining identifiers of virtual broadcast domains (VBDs) in the domain D1;
• (2) for each connectivity group, the computer system obtaining information identifying the one or more VBDs that are members of the connectivity group, wherein at least one of the connectivity groups comprises VBDs in different domains;
• (3) for at least one connectivity group, the computer system obtaining information identifying one or more entities that are to be made members of the connectivity group, each entity being an identification of a user capable of using different network stations;
• (4) for at least one entity U1 which is to be made a member of a connectivity group C1 comprising VBDs in different domains, for each VBD V2 in the connectivity group C1, the computer system causing the network to place the user into the VBD V2.

A method for restricting traffic between network stations in a network comprising a plurality of domains, wherein:

• each network station can have both a first type address and a second type address;
• traffic between network stations within each of the domains is delivered to destination network stations using first type addresses of the destination network stations without using second type addresses of the destination network stations, but between domains traffic is transferred, and is restrictable, using the second type addresses of the destination network stations,
• the method comprising:
• (A) a computer system receiving from a network station, over the network, a user identification;
• (B) the computer system determining, from the user identification, a connectivity group CG1 to which the user identification belongs, wherein:
• the connectivity group CG1 contains a plurality of virtual broadcast domains (VBDs), each VBD being one of said domains or a sub-domain of one of said domains, wherein traffic between network stations within a sub-domain VBD is restrictable to the VBD;
• and
• wherein the connectivity group CG1 contains VBDs in different domains;
• (C) the computer system determining a domain D1 to which the network station belongs;
• (D) the computer system determining one or more VBDs VBD1 which are both in the domain D1 and in the connectivity group CG1, the one or more VBDs VBD1 being less than the entire domain D1;
• and
• (E) the computer system issuing a command to bind the network station to the one or more VBDs VBD1 so as to restrict the network station's traffic within the domain D1.

A structure for restricting traffic between network stations in a network comprising a plurality of domains, wherein:

• each network station can have both a first type address and a second type address;
• traffic between network stations within each of the domains is delivered to destination network stations using first type addresses of the destination network stations without using second type addresses of the destination network stations, but between domains traffic is transferred, and is restrictable, using the second type addresses of the destination network stations,
• the structure comprising:
• means for receiving from a network station, over the network, a user identification;
• means for determining, from the user identification, a connectivity group CG1 to which the user identification belongs, wherein:
• the connectivity group CG1 contains a plurality of virtual broadcast domains (VBDs), each VBD being one of said domains or a sub-domain of one of said domains, wherein traffic between network stations within a sub-domain VBD is restrictable to the VBD;
• and
• wherein the connectivity group CG1 contains VBDs in different domains;
• means for determining a domain D1 to which the network station belongs;
• means for determining one or more VBDs VBD1 which are both in the domain D1 and in the connectivity group CG1, the one or more VBDs VBD1 being less than the entire domain D1;
• and
• means for issuing a command to bind the network station to the one or more VBDs VBD1 so as to restrict the network station's traffic within the domain D1.

A method for creating one or more access control lists (ACLs) for one or more devices that route traffic between network domains, wherein:

• each network station can have both a first type address and a second type address;
• traffic between network stations within each of the domains is delivered to destination network stations using first type addresses of the destination network stations without using second type addresses of the destination network stations, but the one or more devices route traffic between domains using the second type addresses of the destination network stations, and wherein the one or more devices are capable of restricting traffic between domains based on ACLs which specify allowed and/or disallowed traffic through use of the second type addresses,
• the method comprising:
• defining one or more groups of sub-networks such that traffic is to be allowed within each group of sub-networks, wherein each sub-network is a portion of a network domain or is a whole network domain, and, for each group, providing to a computer system identifications of sub-networks that belong to the group, wherein at least one group G1 comprises sub-networks in different domains;
• and
• the computer system generating the one or more ACLs to allow traffic within each group,
• wherein the one or more devices are to have an interface designated to transfer traffic for a sub-network S1 in the group G1;
• wherein generating the one or more ACLs comprises generating an ACL ACL1 for said interface, and wherein for each sub-network S2 in the group G1 (S2.noteq.S1), the ACL ACL1 allows the traffic on the interface between the sub-network S2 and the sub-network S1.

A structure for creating one or more access control lists (ACLs) for one or more devices that route traffic between network domains, wherein:

• each network station can have both a first type address and a second type address;
• traffic between network stations within each of the domains is delivered to destination network stations using first type addresses of the destination network stations without using second type addresses of the destination network stations, but the one or more devices route traffic between domains using the second type addresses of the destination network stations, and wherein the one or more devices are capable of restricting traffic between domains based on ACLs which specify allowed and/or disallowed traffic through use of the second type addresses,
• the structure comprising:
• means for defining for a computer system one or more groups of sub-networks such that traffic is to be allowed within each group, wherein each sub-network is a portion of a network domain or is a whole network domain, the means being also for reading by the computer system, for each group, identifications of sub-networks that belong to the group, wherein at least one group G1 comprises sub-networks in different domains;
• and
• means for generating by the computer system the one or more ACLs to allow traffic within each group,
• wherein the one or more devices are to have an interface designated to transfer traffic for a sub-network S1 in the group G1;
• wherein generating the one or more ACLs comprises generating an ACL ACL1 for said interface, and wherein for each sub-network S2 in the group G1 (S2.noteq.S1), the ACL ACL1 allows the traffic on the interface between the sub-network S2 and the sub-network S1.

A method for establishing connectivity in a network comprising a plurality of domains, wherein:

• each network station can have both a first type address and a second type address;
• traffic between network stations within each of the domains is delivered to destination network stations using first type addresses of the destination network stations without using second type addresses of the destination network stations, but between domains traffic is transferred, and is restrictable, using the second type addresses of the destination network stations;
• at least one domain is capable of having sub-domains defined in the domain such that the domain allows traffic within a single sub-domain but disallows traffic between sub-domains,
• the method comprising:
• providing a computer system with information INF1 defining traffic that belongs to a connectivity group CG1, wherein the connectivity group CG1 is to have sub-domains in different domains at least two of which are each capable of restricting traffic to a sub-domain;
• and
• for at least the connectivity group CG1, the computer system configuring each domain D1 that has a sub-domain SD1 in the connectivity group CG1 so that the domain D1 allows traffic defined by said information INF1 but restricts such traffic to the sub-domain SD1 when the domain delivers traffic using the first type addresses without using the second type addresses.

A structure for establishing connectivity in a network comprising a plurality of domains, wherein:

• each network station can have both a first type address and a second type address;
• traffic between network stations within each of the domains is delivered to destination network stations using first type addresses of the destination network stations without using second type addresses of the destination network stations, but between domains traffic is transferred, and is restrictable, using the second type addresses of the destination network stations;
• at least one domain is capable of having sub-domains defined in the domain such that the domain allows traffic within a single sub-domain but disallows traffic between sub-domains,
• the structure comprising:
• means for receiving, by a computer system, information INF1 defining traffic that belongs to a connectivity group CG1, wherein the connectivity group CG1 is to have sub-domains in different domains at least two of which are each capable of restricting traffic to a sub-domain;
• means for receiving by the computer system, for at least one connectivity group, identifications of sub-domains that are members of the connectivity group;
• and
• means for configuring by the computer system, for at least the connectivity group CG1, each domain D1 that has a sub-domain SD1 in the connectivity group CG1 so that the domain D1 allows traffic defined by said information INF1 but restricts such traffic to the sub-domain SD1 when the domain D1 delivers traffic using the first type addresses without using the second type addresses.

A method for restricting traffic between network stations in a network comprising a plurality of layer 2 domains, wherein traffic between network stations within each layer 2 domain is delivered to destination network stations using layer 2 addresses of the destination network stations without using network layer addresses of the destination network stations, but between domains traffic is transferred, and is restrictable, using the network layer addresses of the destination network stations, the method comprising:

• (A) a computer system receiving from a network station, over the network, a user identification, and also receiving an address of the network station;
• (B) the computer system determining, from the user identification, a connectivity group CG1 to which the user identification belongs, wherein:
• the connectivity group CG1 contains a plurality of VLANs, each VLAN being one of said domains or a sub-domain of one of said domains, wherein traffic between network stations within a sub-domain VLAN is restricted to the VLAN, but traffic between destination stations in VLANs in different domains is restricted to a connectivity group using the network layer addresses of the destination network stations;
• and
• wherein the connectivity group CG1 contains VLANs in different domains;
• (C) the computer system determining, from the address of the network station, the domain D1 to which the network station belongs;
• (D) the computer system determining one or more VLANs which are both in the domain D1 and in the connectivity group CG1;
• and
• (E) the computer system issuing a command to bind the network station to the one or more VLANs which are both in the domain D1 and in the connectivity group CG1 to restrict the network station's traffic within the domain D1.

A method for creating one or more connectivity groups in a network which comprises a plurality of domains, wherein each network station can have a first type address and a second type address, wherein traffic within each of said domains is delivered using first type addresses of destination network stations without using second type addresses of destination network stations, but between domains traffic is transferred using the second type addresses of destination network stations, the method comprising:

• (1) for each domain D1 of at least two of said domains, a computer system obtaining identifiers of virtual broadcast domains (VBDs) in the domain D1;
• (2) for each connectivity group, the computer system obtaining information identifying the one or more VBDs that are members of the connectivity group, wherein at least one of the connectivity groups comprises VBDs in different domains;
• (3) for at least one connectivity group, the computer system obtaining information identifying one or more port entities that are to be made members of the connectivity group, each port entity being a port of a device capable of forwarding traffic within a domain using the first type addresses of destination network stations without using the second type addresses of destination network stations;
• (4) for each domain, the computer system obtaining information on which ports, if any, the domain contains;
• (5) for at least one port entity P1 which is to be made a member of a connectivity group C1 comprising VBDs in different domains, the computer system performing the following operations:
• (5A) determining from the information in (4), a domain D2 to which the port entity belongs;
• (5B) from the information in (2) and VBD identifiers for each domain in (1), determining a VBD V2 which is both in the domain D2 and the connectivity group C1;
• (5C) causing the domain D2 to place the port entity P1 into the VBD V2.