Abstract:
Methods, systems, and computer program products for selective layer 2 port blocking using layer 2 source addresses are disclosed. According to one method, a layer 2 frame is received. An I/O port block list is identified based on a layer 2 source address in the layer 2 frame. A set of ports to which the layer 2 fame should be forwarded is identified. The frame is blocked from being forwarded to ports in the set that are also in the I/O port block list.

Description:
TECHNICAL FIELD  
       [0001]     The subject matter described herein includes methods, systems, and computer program products for implementing layer 2 port blocking. More particularly, the subject matter described herein includes methods, systems, and computer program products for implementing layer 2 port blocking using layer 2 source addresses.  
       BACKGROUND ART  
       [0002]     In layer 2 switching devices, such as Ethernet switches, when a packet or frame is received at a port, a lookup is typically performed in a layer 2 forwarding table. The lookup is performed based on the layer 2 destination address in the frame. If an entry for the destination address is present in the table, the frame may be forwarded to the output port or ports corresponding to the entry. If an entry for the frame is not present in the table, the frame may be flooded on all output ports other than the port on which the frame was received.  
         [0003]     Virtual local area networks (VLANs) can be used to limit the layer 2 flooding domain of a frame. For example, if a layer 2 frame includes a VLAN tag, and an entry is not located for the layer 2 destination address of the frame during the forwarding table lookup, the frame may be flooded only to ports that are members of the same VLAN as the VLAN tag identified in the frame.  
         [0004]     Another lookup that typically occurs when a frame arrives at a layer 2 packet forwarding device is referred to as a learning phase lookup. During the learning phase, when a frame arrives at a port of a layer 2 switching device, the layer 2 source address in the frame is read. A lookup may be performed in the layer 2 forwarding table using the layer 2 source address to determine whether a forwarding table entry exists for the layer 2 source address. If a forwarding table entry corresponding to the layer 2 source address is not present in the forwarding table, the layer 2 source address is learned by adding it to the forwarding table with forwarding information for the entry set to the port on which the frame was received. This information may be communicated to the other ports in the switch so that packets having layer 2 destination addresses corresponding to the learned source address can be forwarded to the correct port. If the layer 2 source address is already present in the forwarding table, it has already been learned, and the learning phase ends.  
         [0005]     In some instances, it may be desirable to implement layer 2 port blocking. For example, it may be desirable to allow ports A and B to communicate with each other but not with port C, even though ports A-C are all members of the same VLAN. One method for implementing such port blocking is to hard-wire the layer 2 switching device so that frames from one port only go to ports with which the port is allowed to communicate. Such a solution lacks granularity and flexibility. For example, it may be desirable to allow some packets from port A to be forwarded to port C and to block other packets from being forwarded from port A to port C.  
         [0006]     Two other methods for providing layer 2 port blocking are referred to by the assignee of the subject matter described herein as limit learning and MAC lockdown. According to limit learning, a set number of MAC addresses that can be learned is configured on a per VLAN basis. Once that number of MAC addresses has been learned, if a frame arrives with a new MAC source address, a black hole entry is added to the forwarding table for that MAC source address so that any packet received with a MAC destination address corresponding to the black hole entry will be discarded. In the MAC lock down feature, an operator issues a run time command to a layer 2 switch to lock down a layer 2 forwarding table so that no additional entries can be learned after the command. Subsequent MAC addresses that are attempted to be learned are added as black hole entries to the table, so that packets with MAC destination addresses corresponding to the black hole entries will be discarded.  
         [0007]     While these security features are each suitable for their intended purpose, there exists a long felt need for improved methods, systems, and computer program products for implementing selective layer 2 port blocking using layer 2 source addresses.  
       SUMMARY  
       [0008]     According to one aspect, the subject matter described herein includes a method for implementing selective layer 2 port blocking using a layer 2 source address. The method includes receiving a layer 2 frame and identifying, based on a layer 2 source address in the layer 2 frame, an I/O port block list. A forwarding phase lookup is performed to identify a set of ports to which the layer 2 frame should be forwarded. Forwarding of the layer 2 frame to ports that are in the set and that are also in the block list is blocked.  
         [0009]     The terms “packet” and “frame” are used interchangeably herein and are intended to refer to a protocol data unit sent over a network with at least one header and a payload. The term “layer 2” is intended to refer to the medium access control (MAC) layer of a network communications protocol stack. An example of a layer 2 implementation suitable for use with the subject matter described herein is an Ethernet layer. The term “layer 3” is intended to refer to the network layer of a network communications protocol stack. An example of a layer 3 implementation suitable for use with the subject matter described herein is an Internet protocol layer.  
         [0010]     The subject matter described herein for implementing selective layer 2 port blocking based on layer 2 source addresses can be implemented using a computer program product comprising computer executable instructions embodied in a computer readable medium. Exemplary computer readable media suitable for implementing the subject matter described herein include disk memory devices, chip memory devices, programmable logic devices, application specific integrated circuits, and downloadable electrical signals. In addition, a computer program product that implements the subject matter described herein may be located on a single device or computing platform or may be distributed across multiple devices or computing platforms.  
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0011]     Preferred embodiments of the subject matter described herein will now be explained with reference to the accompanying drawings of which:  
         [0012]      FIG. 1  is a block diagram illustrating a layer 2/layer 3 packet forwarding device for implementing selective layer 2 port blocking based on layer 2 source addresses according to an embodiment of the subject matter described herein;  
         [0013]      FIG. 2  is a flow chart illustrating exemplary steps for implementing selective layer 2 port blocking using layer 2 source addresses according to an embodiment of the subject matter described herein; and  
         [0014]      FIG. 3  is a flow chart illustrating exemplary steps for implementing selective layer 2 port blocking for layer 2 and layer 3 packets according to an embodiment of the subject matter described herein. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0015]     The subject matter described herein for implementing selective layer 2 port blocking using layer 2 source addresses can be implemented on any suitable processing platform that includes layer 2 switching capabilities. Examples of such platforms include Ethernet switches and IP routers that include Ethernet switching capabilities.  FIG. 1  is a block diagram illustrating an example of such a platform on which the subject matter described herein can be implemented. In  FIG. 1 , layer 2 switch/layer 3 router  100  performs layer 2 switching and layer 3 routing. In the illustrated example, switch/router  100  includes a plurality of input/output (I/O) modules  102 , a switching fabric  104 , and a switch management module  106 . I/O modules  102  each include one or more I/O ports  108 A- 114 B for connecting each I/O module  102  to the external network for sending and receiving packets to and from the network. In order to perform layer 2 and layer 3 packet forwarding, each I/O module  102  includes a lookup engine  116 , a layer 2 forwarding database  118 , and a layer 3 forwarding database  120 . Lookup engine  116  performs lookups in databases  118  and  120  based on layer 2 and layer 3 destination addresses to determine where to forward each received packet. Layer 2 forwarding database  118  includes a table of layer 2 addresses and corresponding forwarding information. Layer 3 forwarding database  120  includes a table of layer 3 addresses and corresponding forwarding information. As will be described in more detail below, layer 2 forwarding database  118  may include, for some entries, I/O port block lists.  
         [0016]     Although in  FIG. 1 , a single lookup engine  116  performs both layer 2 and layer 3 forwarding phase lookups, the subject matter described herein is not limited to such an implementation. In an alternate implementation, the layer 2 and layer 3 lookup engines may be implemented using separate hardware, software, or firmware components.  
         [0017]     In addition, although in  FIG. 1  separate layer 2 and layer 3 forwarding databases are shown, the subject matter described herein is not limited to such an embodiment. The layer 2 and layer 3 forwarding databases may be implemented as separate tables that are part of the same database without departing from the scope of the subject matter described herein.  
         [0018]     Switching fabric  104  switches packets between I/O modules  102  and switch management modules  106 . Switch management module  106  includes a master layer 3 forwarding database  122 , a software lookup engine  124 , and layer 3 routing protocol software  126 . Master layer 3 forwarding database  122  includes a copy of all of the entries in layer 3 forwarding databases  120  maintained by the I/O modules plus any additional entries learned using layer 3 routing protocols implemented by software  126 . Software lookup engine  124  performs lookups in master layer 3 forwarding database  122  for packets received by I/O modules  102  that cannot be forwarded using the layer 3 forwarding data maintained locally by each I/O module.  
         [0019]     In the device illustrated in  FIG. 1 , it may be desirable to implement selective layer 2 port blocking. For example, it may be desirable to selectively block, on a per layer 2 source address basis, packets from being transmitted between groups of I/O ports illustrated in  FIG. 1 . In one implementation, I/O ports  108 A,  108 B,  112 A,  112 B,  114 A, and  114 B may be members of the same VLAN. However, it may be desirable to block certain packets arriving on ports  108 A and  108 B from being forwarded to I/O ports  114 A and  114 B and to block others from being forwarded to ports  112 A and  112 B. In order to implement such a requirement, a layer 2 blocking table may be configured on a per source address basis. Table 1 shown below illustrates an exemplary layer 2 forwarding table for implementing selective layer 2 port blocking according to an embodiment of the subject matter described herein.  
                                     TABLE 1                           Layer 2 Forwarding Data with Source Indexed Port Block Lists                MAC Address   VLAN   Member Ports   Port Block List                       MAC1   5   112A, 112B,   114A, 114B                   114A, 114B           MAC2   5   112A, 112B,   112A, 112B                   114A, 114B           MAC3   5   112A, 112B,   112A, 112B                   114A, 114B                      
 
 The entries in Table 1 are configured to implement the blocking example described above for selectively blocking packets arriving at ports  108 A and  108 B from being forwarded to ports  112 A,  112 B,  114 A, or  114 B on a per layer 2 source address basis. In Table 1, the first column includes MAC addresses. The entries in this column may be populated as MAC addresses are learned. Some of the entries may be statically configured by the switch operator. The second column includes the VLAN identifier, the third column includes the forwarding information for each entry, and fourth column includes the I/O port block lists. 
 
         [0020]     In addition to being used for learning phase lookups, a forwarding table, such as Table 1, may also be used for forwarding phase lookups. For example, if two packets are received at a port that has the data in Table 1, the following steps may occur. Referring to  FIG. 2 , in step  200 , a layer 2 frame is received. For purposes of this example, it will be assumed that the first layer 2 frame has MAC source address (SA)=MAC1, MAC destination address (DA)=MAC2, and a VLAN tag of 5. In step  202 , an I/O port block list may be identified based on the layer 2 source address. Using the data in Table 1 as an example, if the MAC SA=MAC1, the I/O port block list extracted will contain ports  114 A,  114 B.  
         [0021]     In step  204 , a forwarding phase lookup is performed to identify a set of ports to which the frame should be forwarded. Using MAC DA=MAC2 to perform the lookup in Table 1, the member ports to which the frame should be forwarded are  112 A,  112 B,  114 A, and  114 B. In step  204 , the frame is blocked from being forwarded to ports in the set that are in the block list. Using the present example, since  114 A and  114 B are in the block list, the frame will only be forwarded to ports  112 A and  112 B.  
         [0022]     The selectivity of the port blocking can be illustrated by another example where a frame having MAC SA=MAC3, MAC DA=MAC2, and VLAN=5 is received. If such a frame is received, a port block list containing ports  112 A and  112 B is extracted. The destination address is used to locate the same ports as in the previous example. However, rather than forwarding the frame to ports  112 A and  112 B, the frame will be forwarded to ports  114 A and  114 B, because ports  112 A and  112 B are in the I/O port block list for MAC SA=MAC3. Thus, by using a MAC source address as a discriminator to select a port block list and using that list to determine ports to which a frame should be forwarded, fine grain port blocking can be achieved. In addition, because the I/O port block list can be located in the learning phase lookup, the number of lookups is reduced over layer 2 security applications that require lookups outside of the learning and forwarding phase lookups to implement security features.  
         [0023]     Although the example described with regard to  FIG. 2  is based on limiting the layer 2 forwarding domain of a packet that is forwarded based only on layer 2 information, the subject matter described herein is not limited to such an example. Selective layer 2 port blocking using port blocking lists can be implemented for a set of layer 2 ports that is identified using any protocol, including layer 3 protocols.  FIG. 3  is a flow chart illustrating exemplary steps for performing selective layer 2 port blocking based on layer 2 source addresses for layer 2 and layer 3 frames according to an embodiment of the subject matter described herein. Referring to  FIG. 3 , in step  300 , the I/O port block list for a received frame is initially set to null. In step  302 ,l a learning phase lookup is performed based on a layer 2 source address in the received layer 2 frame. As stated above, the layer 2 learning phase lookup may include a lookup in a layer 2 forwarding table at a port on which a frame or packet is received to determine whether an entry corresponding to the layer 2 source address is present. In step  304  if an entry corresponding to the layer 2 source address is present in the forwarding database, learning is not required and control proceeds to step  306  where the I/O port block list corresponding to the packet source address is extracted and stored in a variable referred to as PBL.  
         [0024]     In step  308 , it is determined whether the packet is a layer 3 multicast packet. Layer 3 multicast packets can be identified by a layer 2 destination address of 0×01005E. If this address is present, the frame is a layer 3 multicast frame, and control proceeds to step  310  where a layer 3 lookup is performed to identify an egress port list (EPL) to which the frame should be forwarded. In step  308 , if the frame is determined not to be a layer 3 multicast frame, control proceeds to step  312  where it is determined whether the layer 2 packet destination address is present in the forwarding database. If the layer2 packet destination address is not present in the forwarding database, control proceeds to step  314  where the egress port list is set to the members of the VLAN associated with the received packet.  
         [0025]     In step  312 , if the layer 2 packet destination address is in the forwarding database, control proceeds to step  315  where it is determined whether the packet is addressed to the receiving router&#39;s MAC address. If the packet is addressed to the router&#39;s MAC address, control proceeds to step  316  where it is determined whether the packet is a layer 3 unicast packet. If the packet is a layer 3 unicast packet, control proceeds to step  318 , where a layer 3 lookup is performed based on the layer 3 destination address to identify an egress port list to which the frame should be forwarded. In step  315 , if the packet is not addressed to the router&#39;s MAC address or in step  316 , if it is determined that the packet is not a layer 3 unicast packet, control proceeds to step  320  where the egress port list is extracted from the entry in the layer 2 forwarding database entry that matches the layer 2 destination address in the packet.  
         [0026]     Once the egress port list is identified in step  310 ,  314 ,  318 , or  320 , control proceeds to step  322  where I/O port block list is used to mask out entries from the egress port list. This step may be implemented using bitmaps that correspond to the egress port list and I/O port block list. The egress port list bitmap may include a 1 corresponding to each port to which the packet should be forwarded and zeros for the remaining ports. Similarly, I/O port block list bitmap may include a 1 for each blocked port and zeros for the remaining ports. Accordingly, in order to produce a bitmap with 1 s for each port to which the frame should be forwarded, I/O port block list bitmap may be bit-inverted and ANDed with the egress port list bitmap. The resulting bitmap includes bits corresponding to ports to which the frame should be forwarded. Using a simple computation, such as a logical AND operation, allows the final egress port list to be identified easily in hardware.  
         [0027]     Returning to step  304 , if the layer 2 source address is not present in the forwarding database, control proceeds to step  324  where a MAC source address is learned on the received port. Control then proceeds to steps  308  and  310 ,  312  and  314 , or  315 - 320  where the egress port list is identified and then to step  322  where the list is masked as described above. Thus, using the steps illustrated in  FIG. 3 , selective layer 2 port blocking can be performed for frames that are forwarded based on layer 2 or layer 3 information.  
         [0028]     It will be understood that various details of the invention may be changed without departing from the scope of the invention. Furthermore, the foregoing description is for the purpose of illustration only, and not for the purpose of limitation.