# US 8,751,649 B2 · Port management system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,751,649 B2
- Document ID: US8751649B2
- Status: Granted
- Kind: B2
- Application number: 11/731,135
- Filed: 2007-03-30
- Published: 2008-10-02
- Granted: 2014-06-10
- Earliest claimed: 2005-06-07
- Assignees: Extreme Networks, Inc.
- Applicants: Anil Villait; Nick G. Suizo; Govind raj Desur; Deepika Dwivedi
- Inventors: Anil Villait; Nick G. Suizo; Govind raj Desur; Deepika Dwivedi
- Web page: https://patentgrep.com/patent/US8751649B2

## CPC

- H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play
- H04L 41/08: Configuration management of networks or network elements (address allocation H04L61/50)
- H04L 41/0803: Configuration setting
- H04L 41/0816: the condition being an adaptation, e.g. in response to network events
- H04L 41/0886: {Fully automatic configuration}
- H04L 41/0894: Policy-based network configuration management
- H04L 49/65: Re-configuration of fast packet switches
- G06F 9/30141: {Implementation provisions of register files, e.g. ports}
- G06F 2201/86: Event-based monitoring
- H04L 41/0681: Configuration of triggering conditions
- H04L 41/0809: {Plug-and-play configuration}
- H04L 41/0813: characterised by the conditions triggering a change of settings
- H04L 49/351: for local area network [LAN], e.g. Ethernet switches
- H04L 67/5682: Policies or rules for updating, deleting or replacing the stored data
- Y02D 30/00: Reducing energy consumption in communication networks
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

A method is provided for a port management system in which a switch is automatically provisioned with network resources. A command or set of commands are stored and automatically executed on the switch upon the occurrence of a defined network event. The command or set of commands may be associated with one or more ports on the switch. When executed, the commands cause a change to a port configuration and/or policy on the switch to control access to a network resource. The network resource may include any device or service accessible on the network. The defined network event may include any network event associated with a device or user connected to the network. The command or set of commands may reference variables, control structures, and functions to modify command execution.

## Claims

### Claim 1

A machine-implemented method for automatically provisioning a switch in a network, the method comprising:
storing a command on a storage medium in a switch having a port configuration, the command having variables including at least one of a common variable, an end user profile variable, a device profile variable, and a session variable, and, when executed on a processor on the switch, changing the port configuration of a port on the switch;
associating a defined network event with the command, the defined network event associated with an end user connecting to the network and a device connecting to the network;
further storing, on the storage medium in the switch, current values of variables referenced in the command, the current values determined either prior to or upon an occurrence of the defined network event associated with the command;
detecting in the network the occurrence of the defined network event, the defined network event having been previously associated with the command stored on the storage medium in the switch;
receiving in an input interface on the switch a message communicating the occurrence of the defined network event to the switch;
determining the current value of referenced variables prior to the occurrence of the defined network event associated with the command;
determining the current value of referenced variables upon the occurrence of the defined network event associated with the command;
preparing the command for execution in accordance with the determined values of the referenced variables;
executing the prepared command in the processor on the switch in response to receiving the message communicating the occurrence of the defined network event, wherein executing the prepared command in the processor on the switch includes:
evaluating an expression present in the control structure in the command, the control structure to modify the command's execution based on the evaluated expression;
modifying the command execution to change the port configuration in accordance with the evaluated expression; and
changing the port configuration of the port on the switch in accordance with the determined values of the referenced variables and the evaluated expression.

### Claim 2 (depends on 1)

The method of claim 1, wherein determining the value of the referenced variable upon the occurrence of the defined network event associated with the command is based on parameter values contained in the message for communicating the defined network event to the switch.

### Claim 3 (depends on 2)

The method of claim 2, wherein the parameter values contained in the message for communicating the defined network event to the switch conform to a protocol.

### Claim 4 (depends on 2)

The method of claim 2, wherein the message for communicating the defined network event to the switch was sent from an authentication server connected to the network.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
referencing a function in the command, wherein the function returns a value to modify the command's execution based on the returned value; and
modifying the command execution to change the port configuration in accordance with the returned value of the referenced function.

### Claim 6 (depends on 1)

The method of claim 1, wherein the defined network event associated with the command is an event associated with the device connecting to the network.

### Claim 7 (depends on 6)

The method of claim 6, wherein the defined network event associated with the device is one of a detection and un-detection of the device connecting to the network.

### Claim 8 (depends on 6)

The method of claim 6, wherein the defined network event associated with the device is communicated to the switch using a Link Layer Data Protocol (LLDP).

### Claim 9 (depends on 1)

The method of claim 1, wherein the defined network event associated with the command is an event associated with the end user connecting to the network.

### Claim 10 (depends on 9)

The method of claim 9, wherein the defined network event associated with the end user connecting to the network is one of authenticating and un-authenticating the end user connecting to the network.

### Claim 11 (depends on 10)

The method of claim 10, wherein the defined network event associated with the end user is communicated to the switch using a NetLogin authentication protocol.

### Claim 12 (depends on 11)

The method of claim 11, wherein the NetLogin authentication protocol is one of a MAC-based protocol, a web-based protocol, and an IEEE 802.1X-based protocol.

### Claim 13 (depends on 1)

The method of claim 1, further comprising:
associating the command with a port on the switch; and
executing the command in response to the occurrence of the defined network event to change the port configuration of the associated port.

### Claim 14 (depends on 1)

The method of claim 1, further comprising:
executing the command in one of a persistent and non-persistent modes.

### Claim 15 (depends on 14)

The method of claim 14, further comprising:
determining that the command is executing in persistent mode; and
saving the port configuration change to a persistent repository on the switch to preserve the port configuration change if the switch is re-booted.

### Claim 16 (depends on 1)

The method of claim 1, further comprising:
receiving a request to execute the command from a command line interface; and
executing the command in response to the request.

### Claim 17

A port management system to control access to a network resource, the system comprising:
a repository in which is stored a profile containing a set of commands, the execution of which controls access to a network resource via a port on a switch, wherein the profile containing the set of commands further includes a command that references a variable, the variable including at least one of a common variable, an end user profile variable, a device profile variable, and a session variable, the referenced variable having a value stored in the repository that is determined either prior to or upon an occurrence of a defined network event associated with the profile, and a control structure to conditionally modify the profile execution depending on the value of the referenced variable stored in the repository;
a definition of the defined network event, the occurrence of which triggers execution of the profile, the defined network event associated with an end user accessing the network and a device accessing the network;
a message communicating the occurrence of the defined network event to the switch;
a port manager having an interface to create the profile, define the defined network event, associate the profile with the defined network event and a port on the switch, and to receive the message communicating the occurrence of the defined network event to the switch; and
a processor in which to operate the port manager, and in which to determine the value of the referenced variable prior to or upon the occurrence of the defined network event and prepare the profile for execution in accordance with the determined value of the referenced variable, execute the prepared profile upon receipt of the message communicating the occurrence of the defined network event and, in accordance with the control structure, to conditionally modify the prepared profile execution depending on the determined value of the referenced variable, the execution of the prepared profile to control access to the network resource via the associated port on the switch.

### Claim 18 (depends on 17)

The port management system of claim 17, wherein the profile containing the set of commands includes a command that references a function that returns a value, and wherein the processor executes the profile in accordance with the returned value.

### Claim 19 (depends on 17)

The port management system of claim 17, wherein the defined network event is an event associated with the device accessing the network.

### Claim 20 (depends on 19)

The port management system of claim 19, wherein the defined network event associated with the device is one of a detection and un-detection of the device accessing the network.

### Claim 21 (depends on 19)

The port management system of claim 19, wherein the defined network event associated with the device is communicated to the switch using a Link Layer Data Protocol (LLDP).

### Claim 22 (depends on 17)

The port management system of claim 17, wherein the defined network event is an event associated with the end user accessing the network.

### Claim 23 (depends on 22)

The port management system of claim 22, wherein the defined network event associated with the end user is one of authenticating and un-authenticating the end user accessing the network.

### Claim 24 (depends on 22)

The port management system of claim 22, wherein the defined network event associated with the end user is communicated to the switch using a NetLogin authentication protocol.

### Claim 25 (depends on 24)

The port management system of claim 24, wherein the NetLogin authentication protocol is one of a MAC-based protocol, a web-based protocol, and an IEEE 802.1X-based protocol.

### Claim 26 (depends on 17)

The port management system of claim 17, in which to execute the profile upon the occurrence of the defined network event to control access to the network resource via the associated port on the switch includes executing a command in the profile that causes a port configuration change.

### Claim 27 (depends on 17)

The port management system of claim 17, in which to execute the profile upon the occurrence of the defined network event to control access to the network resource via the associated port on the switch includes executing a command in the profile that causes a policy change.

### Claim 28 (depends on 17)

The port management system of claim 17, wherein the defined network event is a timer, the expiration of which triggers execution of the profile.

### Claim 29 (depends on 28)

The port management system of claim 28, wherein the timer specifies a time at which the timer expires.

### Claim 30 (depends on 28)

The port management system of claim 28, wherein the timer specifies an interval after which the timer expires.

### Claim 31 (depends on 17)

The port management system of claim 17, wherein the network resource is a device accessible via the network.

### Claim 32 (depends on 17)

The port management system of claim 17, wherein the network resource is a service accessible via the network.

### Claim 33 (depends on 1)

The method of claim 1 where the current value of referenced variables determined prior to the occurrence of the defined network event associated with the command include:
values for common variables available for use in any command; and
values for session variables available for use in particular commands for variable management.

### Claim 34 (depends on 1)

The method of claim 1, wherein the current value of referenced variables determined upon the occurrence of the defined network event associated with the command include:
values for user profile variables including a name of the user that was authenticated, the number of authenticated users on the affected switch port after the occurrence of the defined network event, the MAC or IP address of the user, and the port and VLAN associated with the defined network event; and
values for device profile variables including a device identification, including a MAC or IP address of a device, and a power, manufacturer and model name of a device.

### Claim 35 (depends on 17)

The port management system of claim 17, wherein the value of the referenced variable determined prior to the occurrence of the defined network event associated with the command include:
values for common variables available for use in any command; and
values for session variables available for use in particular commands for variable management.

### Claim 36 (depends on 17)

The port management system of claim 17, wherein the value of referenced variables determined upon the occurrence of the defined network event associated with the command include:
values for user profile variables including a name of the user that was authenticated, the number of authenticated users on the affected switch port after the occurrence of the defined network event, the MAC or IP address of the user, and the port and VLAN associated with the defined network event; and
values for device profile variables including a device identification, including a MAC or IP address of a device, and a power, manufacturer and model name of a device.