Method for enabling mobility of client devices in large scale unified networks

Embodiments herein include systems and methods for providing a mechanism to enable smooth, seamless, and reliable connectivity for wireless devices in a unified network. The system supports roaming of mobile units across mobility switches. A given mobile unit can retain its IP address in both intra-subnet and inter-subnet roaming scenarios. The given mobile unit also retains its membership to a mobility VLAN to which it had been assigned, even during roaming scenarios. Embodiments include a framework for wireless switches to advertise VLANs they support to peer wireless switches in the mobility domain, and to advertise their capability to act as VLAN servers for those VLANs. Embodiments support VLAN membership management capabilities that allow access points and peer wireless switches to request wireless switches to add VLANs to the tunnels they share.

BACKGROUND

The present disclosure relates to network computing. Computer networks typically include a collection of computing devices enabled to communicate with each other for handling data traffic and control instructions. For example, such devices can include servers, data centers, routers, network switches, management applications, wireless access points, and client computers. Computer networks can provide network connectivity to wired computing devices and/or wireless computing devices. Certain computer networks can provide an environment in which both wired and wireless users are supported by a same set of network switches. Such an environment can be described as a unified network.

Computer networks can include various configurations. One such configuration, known as a local area network (LAN), provides network connectivity to a group of client computers. This group is typically small relative to other networks, and is often limited to a specific geographical area or network switch. A wireless local area network (WLAN) allows computing devices to move around within a local area and maintain network connectivity. A virtual local area network (VLAN) enables a group of client computers to communicate and access specific resources as members of a given broadcast domain even if the various member client computers are not attached to the same network switch.

SUMMARY

Conventional mechanisms for providing network connectivity to wireless devices in a large-scale unified network, such as layer 3 network, have challenges to enable smooth mobility of these wireless devices within a given mobility domain. The mobility domain includes mobility switches, which form a wireless data plane. The mobility switches, in a unified network, can include network switches that handle traffic for both wired and wireless devices. Such network switches can also act as a server for a particular VLAN that is accessible to both wired and wireless users. There are challenges associated with providing a VLAN to both wired and wireless devices, especially with networks that include two or more mobility switches. VLANs are typically based on membership, with a specific mobility switch acting as a VLAN server for a specific group of hosts. When a wireless computing device, also known as a mobile unit, which is a member of a particular VLAN roams from one mobile switch to another mobile switch, the mobile unit can lose connectivity to the VLAN, or at least lose reliable connectivity. Conventional mobile IP solutions, such as proxy mobile IP, have attempted to solve this problem. These solutions, however, can cause triangular routing and other security problems in the network. Another problem is that such mobile IP solutions mandate centralized deployments to solve multicast issues. An additional disadvantage is that only IP traffic is addressed, and a separate implementation is required to support IP version 4 and IP version 6.

Techniques disclosed herein include systems and methods for providing a mechanism to enable smooth, seamless, and reliable connectivity for wireless devices in a unified network. The system supports roaming of mobile units across mobility switches. A given mobile unit can retain its IP address in both intra-subnet and inter-subnet roaming scenarios. The given mobile unit also retains its membership to the mobility VLAN to which it had been assigned, even during roaming scenarios.

In one embodiment, a mobility agent acts to enable mobility of client devices. The mobility agent establishes a first mobility tunnel between a first mobility switch and a second mobility switch within a mobility domain. The mobility domain is typically a geographical region where a wireless system provides the same set of services for wireless network connectivity to mobile units. It consists of multiple mobility VLANs, each of which is an independent broadcast domain spanning across the full mobility domain. Mobile units can include any computing device having circuitry for wireless data communication. The first mobility switch and the second mobility switch are network switches that process data traffic from one or more mobile units. The first mobility tunnel functions as part of a data plane by providing a connection for wireless data traffic between the mobility switches. The mobility tunnel also acts as a control channel for exchanging control messaging. The mobility agent exchanges advertisements between the first mobility switch and the second mobility switch via the first mobility tunnel. The advertisements identify mobility Virtual Local Area Networks (VLANs) for which each respective mobility switch acts as a mobility VLAN server. The mobility VLAN server provides a specific VLAN to wireless users. The first mobility switch acts as a first mobility VLAN server for a first mobility VLAN.

The mobility agent receives a request to add the second mobility switch as a member of the first mobility VLAN. The mobility agent receives this request via the first mobility tunnel. The mobility agent also receives this request in response to a first mobile unit attempting to connect to the first mobility VLAN via the second mobility switch. This first mobile unit is a member of the first mobility VLAN. The mobility agent then adds the first mobility tunnel as a member of the first mobility VLAN to enable the second mobility switch to access the first mobility VLAN. The second mobility switch can then handle traffic to and from the mobile unit as part of the first mobility VLAN.

In another embodiment, the mobility agent establishes a first access tunnel between the first mobility switch and a first access point device. The first access point device has a network connection to the first mobility switch. The first access point device provides wireless network connectivity to one or more mobile units. For example, the access point device can include wireless transmission circuitry for relaying traffic between various mobile units and a given mobility switch. A connection between the access point device and a mobility switch can be either a wired or wireless connection. The mobility agent establishes a second access tunnel between the second mobility switch and a second access point device. The second access point device has a network connection to the second mobility switch. The second access point device provides wireless network connectivity to one or more mobile units within the mobility domain. The mobility agent then receives a request to add the second access point device as a member of the first mobility VLAN. The mobility agent receives this request via the second access tunnel. The mobility agent receives this request in response to the first mobile unit attempting to connect to the first mobility VLAN via the second access point device. Adding the first mobility tunnel and the second access tunnel as members of the first mobility VLAN enables the first mobile unit to retain an Internet Protocol address assigned to the first mobile unit as part of membership in the first mobility VLAN, even when the second mobility switch is part of a different subnet than the first mobility switch.

In another embodiment, the mobility agent receives a request from the second mobility switch to move or transfer the first mobility VLAN to the second mobility switch. The mobility agent receives this request in response to the first mobile unit attempting to connect to the first mobility VLAN via the second access point device. The mobility agent then causes the second mobility switch to act as the first mobility VLAN server. The first mobility VLAN can be either moved, so that the second mobility switch now acts as the first mobility VLAN server, or copied, so that both mobility switches now act as VLAN servers for the first mobility VLAN. Also, the VLAN server on the second mobility switch can be temporary or permanent.

Yet other embodiments herein include software programs to perform the steps and operations summarized above and disclosed in detail below. One such embodiment comprises a computer program product that has a computer-storage medium (e.g., a non-transitory, tangible computer readable storage media, disparately located or commonly located storage media, computer storage media or medium, etc.) including computer program logic encoded thereon that, when performed in a computerized device having a processor and corresponding memory, programs the processor to perform the operations disclosed herein. Such arrangements are typically provided as software, firmware, microcode, code data (e.g., data structures), etc., arranged or encoded on a computer readable storage medium such as an optical medium (e.g., CD-ROM), floppy disk, hard disk, one or more ROM or RAM or PROM chips, an Application Specific Integrated Circuit (ASIC), and so on. The software or firmware or other such configurations can be installed onto a computerized device to cause the computerized device to perform the techniques explained herein.

Accordingly, one particular embodiment of the present disclosure is directed to a computer program product that includes one or more computer storage media having instructions stored thereon for supporting operations such as: establishing a first mobility tunnel between a first mobility switch and a second mobility switch within a mobility domain, the mobility domain providing wireless network connectivity for mobile units, the first mobility switch and the second mobility switch being network switches that process data traffic from one or more mobile units, the first mobility tunnel providing a connection for control messaging between the mobility switches; exchanging advertisements between the first mobility switch and the second mobility switch via the first mobility tunnel, the advertisements identifying mobility Virtual Local Area Networks (VLANs) for which each respective mobility switch acts as a mobility VLAN server, the first mobility switch acting as a first mobility VLAN server for a first mobility VLAN; receiving a request to add the second mobility switch as a member of the first mobility VLAN, the request received via the first mobility tunnel in response to a first mobile unit attempting to connect to the first mobility VLAN via the second mobility switch, the first mobile unit being a member of the first mobility VLAN; and adding the first mobility tunnel as a member of the first mobility VLAN to enable the second mobility switch to access the first mobility VLAN. The instructions, and method as described herein, when carried out by a processor of a respective computer device, cause the processor to perform the methods disclosed herein.

Other embodiments of the present disclosure include software programs to perform any of the method embodiment steps and operations summarized above and disclosed in detail below.

Of course, the order of discussion of the different steps as described herein has been presented for clarity sake. In general, these steps can be performed in any suitable order.

Also, it is to be understood that each of the systems, methods, apparatuses, etc. herein can be embodied strictly as a software program, as a hybrid of software and hardware, or as hardware alone such as within a processor, or within an operating system or within a software application, or via a non-software application such a person performing all or part of the operations. Example embodiments as described herein may be implemented in products and/or software applications such as those manufactured by Avaya, Inc. of Lincroft, N.J.

As discussed above, techniques herein are well suited for use in software applications supporting mobility of wireless devices across network switches. It should be noted, however, that embodiments herein are not limited to use in such applications and that the techniques discussed herein are well suited for other applications as well.

Additionally, although each of the different features, techniques, configurations, etc. herein may be discussed in different places of this disclosure, it is intended that each of the concepts can be executed independently of each other or in combination with each other. Accordingly, the present invention can be embodied and viewed in many different ways.

DETAILED DESCRIPTION

Techniques disclosed herein include systems and methods for providing a mechanism to enable smooth, seamless, and reliable connectivity for wireless devices in a unified network. The system supports roaming of mobile units across mobility switches. A given mobile unit can retain its IP address in both intra-subnet and inter-subnet roaming scenarios. The given mobile unit also retains its membership to the mobility VLAN to which it had been assigned, even during roaming scenarios.

The mobility domain includes mobility switches that form a wireless data plane. The system supports roaming of mobile units across mobility switches. Each mobile unit can be assigned a mobility VLAN name and mobility VLAN identifier, with the scope of the mobility VLAN being valid in the mobility domain. The mobility VLAN is mapped to a local (static) VLAN on mobility switches. When a mobile unit roams to a switch on which a local mapping (association) for the mobility VLAN is not available, then packets need to be tunneled to a mobility switch that provides connectivity for the mobility VLAN. The system enables mobility switches in the mobility domain to be aware of the availability of mobility switches that provide service for various VLANs in the mobility domain.

A mobility VLAN management protocol and associated mobility agent provide a framework for wireless switches to advertise VLANs, that they support, to peer wireless switches in the mobility domain, and to advertise their capability to act as VLAN servers for various VLANs. Wireless switches refer to network switches structured or configured to handle traffic from wireless computing devices. The protocol also provides support for access points to request that the wireless switches add a particular VLAN to an access tunnel. The protocol supports VLAN membership management capabilities, which allow access points and peer wireless switches to request wireless switches to add VLANs to the tunnels that they share.

FIG. 1illustrates a portion of an example wireless network system. The wireless network system consists of mobility switches144and145, access point devices134and135, and a mobile unit120that can roam between access points. A mobility tunnel148provides data connectivity between mobility switch144and mobility switch145. Access tunnels138and139provide data connectivity between Access point134and mobility switch144, and access point135and mobility switch145respectively. Mobile unit120can connect wirelessly to access point134or to access point135depending on a roaming location. Data packets or frames from mobile unit120will first reach access point134. Access point134will pass received frames to mobility switch144through access tunnel138. Access tunnel138is a secure tunnel port. Mobility switch144makes a packet forwarding decision. Mobility switch144inspects data packets to determine where to send the data packets based on a destination address.

There are two kinds of tunnel ports. One kind of tunnel port can exist between access points and mobility switches, and the other kind of tunnel port can exist between mobility switches. Any protocol can be used for establishing these tunnels. A tunnel protocols can be used to set up, maintain, and tear down tunnels in the data plane. Tunnel protocols can offer control and data packet transfer services to other layers in the system. A mobility VLAN management protocol can operate over a control channel offered by the tunnel protocol to provide VLAN management services on the access and mobility tunnels. Access tunnels can be set up and managed by an access tunnel protocol. The access tunnel protocol includes a client that resides on the access point, and a server that resides on the mobility switch. Likewise, the mobility tunnels can be set up and managed by a mobility tunnel protocol using client and server components residing on mobility switches.

Tunnel protocols can be based on client/server architecture. The client component can initiate session proceedings (tunnel setup) by sending a join request to the server. The server can either accept or reject the join request, by indicating this in a join response. If the server accepts the join request, then the server signals this acceptance in the join response, and the tunnel moves to an established state. Once the tunnel is established, then either the client or server and can initiate transactions and notifications. Whichever endpoint that initiates a transaction assumes the role of a client for that transaction, and the endpoint which received the transaction request assumes the role of the server for that particular transaction. Either the client or the server can send single notification messages. The tunnel client is responsible for maintaining freshness of the tunnel by periodically initiating a keep alive transaction. When either the client or server endpoint wants to end or tear down the tunnel, the endpoint executes this by initiating a leave transaction. The leave transaction completes when the endpoint receiving the leave request responds with a leave response.

Peer mobility switches in a given mobility domain share a mobility tunnel. Once the mobility switch discovers a peer mobility switch, the mobility switch determines a role (client/server) that it will play in the tunnel protocol. In one example, the mobility switch with a lesser IP address can assume the role of the client while the peer mobility switch assumes the role of a server.

In the mobility domain, data frames can belong to a different network, such as VLAN. In a normal situation, such as when mobile unit120associates to access point134, mobile unit120will need to authenticate with the mobility domain. When mobile unit120authenticates with the mobility network, the mobile unit120acquires access to a corresponding VLAN (170), as a wireless controller will pass the relevant VLAN information to access point134. The wireless controller is shown and described in more detail inFIG. 5. The access point134will request mobility switch144to gain access to VLAN170. This is to acquire VLAN membership on access tunnel port138. In response to this request, mobility agent140can add mobility tunnel138to VLAN170to enable mobile unit120to access VLAN170.

Each mobility switch can be configured to act as a VLAN server for one or more VLANs. Each mobility switch in the mobility domain, that is the mobility switches that provide mobility to VLANs, can also advertise their capability through mobility agents. Each mobility switch that does not provide connectivity to advertised mobility VLANs, can consume advertisements and record this information so that whenever a mobile unit attaches to a mobility switch that is not providing connectivity to the given VLAN, then that given mobility switch can contact a peer mobility switch that provides connectivity to the given VLAN. In other words, mobility switches that provide connectivity to VLANs can advertise their capability as VLAN servers, and mobility switches that do not provide connectivity to VLANs can record these advertisements and subsequently acquire membership to the VLAN servers to provide connectivity. Mobility switches can advertise a subset of VLANs to other mobility switches so that each mobility switch both sends and receives advertisements.

For example, mobility switch144provides connectivity to VLAN170. Mobility switch144advertises this connectivity to mobility switch145, and to any other mobility switches within the mobility domain. Mobility switch145, which is not providing connectivity to VLAN170will mark mobility switch144as VLAN server171for VLAN170. In this example, mobile unit120is a member of the VLAN170. When mobile unit120roams to mobility switch145, connectivity to VLAN170is initially absent. In response, mobility switch145passes frames to mobility switch144because mobility switch144is the VLAN server170. With no configuration change, VLAN170will remain at mobility switch144while being accessible via mobility switch145. In other example embodiments VLAN170can be moved to mobility switch145, or to another given mobility switch. In other words, a user or administrator can move a given VLAN server to a different mobility switch as desired. In other embodiments, several mobility switches can act as a VLAN server for a given VLAN.

Mobility tunnel148provides a communication channel between mobility switches144and145for the control exchange to advertise and to establish memberships. In example embodimentFIG. 1, there are two a mobility switches with one mobility tunnel connecting the mobility switches. By way of another non-limiting example, a given mobility domain or wireless system might have a few, or dozens, or hundreds of mobility switches. Each mobility switch can create multiple mobility tunnels to create a communication channel with other mobility switches within a given mobility domain. These mobility tunnels can be maintained continually similar to virtual wires between mobility switches. Mobility agents on each of the mobility switches can then change membership of those tunnels to specific VLANs according to requests from other mobility switches.

Advertising VLANs supported by mobility switches can be a continual process. Mobility agent140can publish VLAN mappings to a VLAN advertisement area, such as a group of mobility switches or other subset of a mobility domain. Mobility agent140can subsequently publish modifications to existing VLAN associations, removals of existing associations, and addition of new VLAN associations. Mobility switches can follow a periodic full update model for sending advertisements to peer mobility switches. Such an advertisement would contain a full list of supported VLANs sent out at a specific interval. Alternatively, advertisements can be sent as changes relative to a previous advertisement transmission.

In another example embodiment mobility switch144might act as a VLAN server for multiple different VLANs. In this example, and in response to a request for permission to access one of the multiple VLANs, mobility switch144can add the corresponding mobility tunnel to the requested VLAN, and then return a message response indicating that the requesting clients or requesting mobility switches are now a member of the requested VLAN. Thus, the mobility agent manages port membership of VLANs, and creates a virtual extension of VLAN170. This virtual extension of VLAN170can extend to a dynamically created temporary VLAN on mobility switch145, thus allowing mobile unit120to access VLAN170. Mobility switch145can then process data traffic locally for roaming mobile units.

Mobility VLANs can function to manage access to resources for particular groups of client devices or users. Accordingly, a wireless controller can receive instructions that a particular user needs to be assigned to a particular mobility VLAN. This can provide logical and practical benefits. For example, an engineering user may be assigned to an engineering VLAN, while a financial user may be signed to a financial VLAN, wherein both users can be part of a same organization. In another example, VLANs can be segregated by building number, or by particular users. VLANs can provide various levels of control, security, and access. In another example, a restricted access VLAN can be assigned to guest users. After creating VLAN assignments, mobility agents operate to keep a given user in an assigned VLAN wherever the user roams.

In a unified network, the mobility network typically needs to be bridged to a wired network. For such bridging, mobility VLANs need to be mapped to a local VLAN. Wireless network and mobility agents function to manage roaming of wireless clients, so that irrespective of which access point to which a client roams, traffic from that client can be forwarded to the switch or switches where a corresponding mobility VLAN is mapped to a local or static VLAN.

Functionality supported by the wireless system and, more particularly, functionality associated with mobility agent140will now be discussed via flowcharts and illustrations inFIG. 2throughFIG. 5. For purposes of the following discussion, the mobility agent140or other appropriate entity performs steps in the flowcharts.

Now describing embodiments more specifically,FIG. 2is a flow chart illustrating embodiments disclosed herein. In step210, mobility agent140establishes a first mobility tunnel148between a first mobility switch144and a second mobility switch145within a mobility domain. The mobility domain provides wireless network connectivity for mobile units. Mobile units can include a computing device having wireless network connection capability. For example, mobile units can include laptop computers, netbooks, cell phones, PDAs, and so forth. The first mobility switch144and the second mobility switch145are network switches that process data traffic from one or more mobile units. The first mobility tunnel148provides a connection for control messaging and data traffic between the mobility switches.

In step220, mobility agent140exchanges advertisements between the first mobility switch144and the second mobility switch145via the first mobility tunnel148. The exchanged advertisements identify mobility virtual local area networks (VLANs) for which each respective mobility switch acts as a mobility VLAN server. Mobility VLANs refers to VLANs that provide membership to some wireless users or wireless computing devices. The first mobility switch144acts as a first mobility VLAN server171for a first mobility VLAN170.

In step230, mobility agent140receives a request to add the second mobility switch145as a member of the first mobility VLAN170. Mobility agent140receives this request via the first mobility tunnel148in response to a first mobile unit120attempting to connect to the first mobility VLAN170via the second mobility switch145. The first mobile unit120is a member of the first mobility VLAN170.

In step240, mobility agent140adds the first mobility tunnel148as a member of the first mobility VLAN170to enable the second mobility switch145to access the first mobility VLAN170, thereby enabling seamless mobility within the mobility domain.

FIGS. 3 and 4expand on the flowchart ofFIG. 2by providing additional features and functionality.

In step210, mobility agent140establishes a first mobility tunnel148between a first mobility switch144and a second mobility switch145within a mobility domain. The mobility domain provides wireless network connectivity for mobile units. The first mobility switch144and the second mobility switch145are network switches that process data traffic from one or more mobile units. The first mobility tunnel148provides a connection for control messaging and data traffic between the mobility switches.

In step212, mobility agent140maps the first mobility VLAN170to a static VLAN on the first mobility switch144. In this case, each mobility switch provides network connectivity to both mobile units and wired computing devices. In other words, this network switch is unified in that the switch provides a mobility network to both types of devices.

In step220, mobility agent140exchanges advertisements between the first mobility switch144and the second mobility switch145via the first mobility tunnel148. The exchanged advertisements identify mobility virtual local area networks (VLANs) for which each respective mobility switch acts as a mobility VLAN server. Mobility VLANs refers to VLANs that provide membership to at least one or more wireless users or wireless computing devices. The first mobility switch144acts as a first mobility VLAN server171for a first mobility VLAN170.

In step221, mobility agent140records respective access to mobility VLANs in a VLAN server table at each respective mobility switch.

In step224, mobility agent140establishes a first access tunnel138between the first mobility switch144and a first access point device134. The first access point device134has a network connection to the first mobility switch144. The first access point device134provides wireless network connectivity to one or more mobile units.

In step226, mobility agent140establishes a second access tunnel139between the second mobility switch145and a second access point device135. The second access point device135has a network connection to the second mobility switch145. The second access point device135provides wireless network connectivity to one or more mobile units120within the mobility domain.

In step230, mobility agent140receives a request to add the second mobility switch145as a member of the first mobility VLAN170. Mobility agent140receives this request via the first mobility tunnel148in response to a first mobile unit120attempting to connect to the first mobility VLAN170via the second mobility switch145. The first mobile unit120is a member of the first mobility VLAN170.

In step231mobility agent140receives a request to add the second access point device135as a member of the first mobility VLAN170. The mobility agent140receives this request via the second access tunnel135in response to the first mobile unit attempting to connect to the first mobility VLAN170via the second access point device. The mobility agent140can receive this request before receiving the request to add the second mobility switch145as a member of the first mobility VLAN170

In step240, mobility agent140adds the first mobility tunnel148as a member of the first mobility VLAN170to enable the second mobility switch145to access the first mobility VLAN170, thereby enabling seamless mobility within the mobility domain.

In step241, mobility agent140enables the first mobile unit120to retain an Internet protocol address assigned to the first mobile unit120as part of membership in the first mobility VLAN170.

In step250, mobility agent140receives a request from the second mobility switch145to move the first mobility VLAN170to the second mobility switch145. Mobility agent140receives this request in response to the first mobile unit120attempting to connect to the first mobility VLAN170via the second access point device135.

In step260, mobility agent140causes the second mobility switch145to act as the first mobility VLAN server171.

In another embodiment, mobility agent140load balances a number of mobility VLANs assigned to each mobility switch based a computing load that each mobility switch can support. Such load balancing can be based on an amount of client computing devices that each mobility switch can support and/or an amount of traffic being processed. Different network switches have different capacities with respect to the number of users that each network switch can support

Embodiments also support roaming across mobility domains. A wireless network can include at least two distinct mobility domains. With two distinct domains, mobility agent140exchanges advertisements between mobility switches across the two distinct mobility domains to provide access across the two distinct mobility domains to the first mobility VLAN170while selectively preventing access to other mobility VLANs across the two distinct mobility domains. For example, a large academic campus might be divided into several separate mobility domains. In this example campus, a particular VLAN for a group of students might not allow roaming, or seamless roaming, to other parts of the campus, while a VLAN that includes membership for administrative staff and professors might enable seamless roaming across the entire campus. In such an example scenario, mobility agent140can proxy VLAN servers across domains. Mobility agent140can select specific VLANs that are permitted to be proxied, while restricting other VLANs.

FIG. 5includes a flow chart that illustrates an example process flow of mobility VLAN management within a wireless system.FIG. 5focuses on the protocol between two or more mobility agents, and between a mobility agent and an access point. The mobility VLAN management protocol can run on top of both the mobility tunnels and the access tunnels. Across access tunnels, that is, between an access point and a mobility switch, control messaging primarily focuses on membership management of VLANs. Across mobility tunnels, that is between/among mobility agents, the protocol focuses on both membership management and on advertisements.

The mobility domain can include several entities including mobile unit120, access point135, mobility switch/mobility agent145/140, peer mobility switch/mobility agent144/140, and wireless control plane160, which is also known as a mobility controller.

At step503, mobility agent140initializes. At step506, mobility switch145establishes a mobility tunnel with peer mobility switch144, and then in step509the mobility switches exchange advertisements indicating whichever VLAN servers are on each respective mobility switch. In step512, based on those advertisements, mobility agent140builds a VLAN server table in mobility switch145. This enables each mobility switch to know which peer mobility switch has access to which specific VLANs. In step515, mobility agents maintain mobility tunnels using keep alive packets to keep the mobility tunnel connection live as if it were a physical link. Keep alive packets can be control packets periodically transmitted across the mobility tunnel.

In step518, mobile unit120associates access point135using an associate message. In step521, access point135communicates directly to wireless controller160to authenticate mobile unit120. By way of a non-limiting example, the wireless controller160can include Remote Authentication Dial In User Service (RADIUS) as an authentication protocol. Step521is also used to establish access authorizations of mobile unit120. In step524, wireless control plane160accesses the authentication request for mobile unit120, and can indicate that the mobile unit client is a member of a particular VLAN, and provide a mobility VLAN identification. The mobility VLAN identification maps a mobility VLAN name to a unique ID within the mobility domain. Configured VLAN names are mapped to VLAN IDs in an address space. A VLAN address space is used to map the VLAN name to a VLAN number, and this number is passed back to access point135.

In step527, access point135seeks a mobility switch that already has access to a particular VLAN requested or designated for mobile unit120. If mobile unit120is new to a particular access point that does not have access to the particular VLAN, then access point135sends an add VLAN request to the mobility switch145and includes the mobility VLAN ID in this request. This request can be transmitted as a VLAN membership management message. In step530mobility switch145attempts to make a VLAN server election based on the VLAN ID by looking in the server table to determine if the particular VLAN is available locally or on a remote mobility switch. In this example, mobility agent140determines that a particular VLAN is available on peer mobility switch144, and mobility switch145does not currently have access to the requested VLAN.

In step533, mobility switch145sends an add VLAN request to peer mobility switch144. In step536, a mobility switch144examines its server table and determines that mobility switch144includes local access to the requested VLAN. In step539mobility agent140adds the mobility tunnel, to which the request was received, to the particular VLAN that is locally present. For example, mobility agent140can add to a membership list or modify a VLAN membership table, and send a return message back through the same mobility tunnel. In step542, mobility switch145creates a remote VLAN, which is a temporary VLAN created dynamically by the mobility switch145. Mobility switch145also connects the access tunnel and the mobility tunnel to that temporary VLAN. In step545, mobility switch145sends a VLAN membership added message to access point135.

In some embodiments, step527through step545can be executed once per VLAN. Thus, if another client comes to a same employee VLAN on a same access point, then the access point simply increases or increments a reference count at the access point without having to propagate associate messages to the mobility switches or wireless controller. Subsequent accesses by members of the particular VLAN are then managed locally at the access point. Mobility switch145can also execute a similar reference counting when a different access point requests membership for a same VLAN without actually sending a corresponding request to the remote switch144, similar to how an access point reference counts.

In some embodiments, the time duration from the point of sending associate message to a point at which a client can actually start sending traffic, can be less than about 50 milliseconds. Once memberships are established, access points can function by transmitting a learning frame through tunnels (step548) using various protocols such as Gratuitous Address Resolution Protocol (GARP). Such a learning frame can inform mobility switches that a particular client MAC address is available on specific VLAN ports, special ports, and physical ports, and can also identify a mapping of the mobility VLAN to a static VLAN. This helps ensure that data traffic reaches a correct switch so that in step551, data packets can be exchanged between mobile unit120and a corresponding node180.

If mobile unit120roams to a different mobility switch and different access points, then the association process will repeat. In this roaming example, the access point will first look to access the particular VLAN. If this new access point already has access to the new VLAN, then this access point simply increments the counter, otherwise, the process ofFIG. 5is repeated.

In some embodiments, a mobile client or the wireless controller, on behalf of a wireless client, may execute a “pre-authentication” process with an access point ahead of an actual association process to minimize roaming delay. In such cases, the access point135can trigger the process ofFIG. 5in response to such a pre authentication process such that when the mobile unit actually associates, the VLAN membership is pre-established with the remote switch144.

In yet another embodiment, mobility agent140can act to teardown or otherwise remove VLAN memberships. Mobility agent140can remove VLAN memberships under various conditions. For example, if an access point detects that a certain accessible VLAN is no longer being used by any associated client for a specified amount of time (idle time), then the access point can determine to release membership to the VLAN by sending a VLAN Membership Management remove request to mobility switch145. Similarly, when remote mobility switch145detects that a dynamically created mobility VLAN is no longer a member of any access tunnels for a specified amount of time (idle time), then mobility agent140can release membership to the VLAN by sending a VLAN Membership Management remove request to VLAN server mobility switch (144). In another condition, when an access tunnel or mobility tunnel is deleted, a mobility switch can remove VLAN memberships. When a mobility VLAN is deleted, all mobility switches can remove memberships and send messages to access points through access tunnels to notify of a lost VLAN membership. When an administrator removes a given VLAN server configuration on mobility switch144, then mobility agent140can send a notification to peer switches145indicating a corresponding lost membership. Also, when there are multiple VLAN servers for a same VLAN, remote mobility switch145can choose to move from one VLAN server to another by releasing membership with one mobility switch and requesting membership to another mobility switch.

FIG. 6shows an example physical embodiment according to techniques disclosed herein. InFIG. 6, computer system110is shown connected to display monitor130for displaying a graphical user interface133for a user106to use a mobility agent140for processing data using input devices116. In some embodiments, computer system110can execute mobility agent140independent of user input, or in response to various inputs. Repository181can optionally be used for storing client data both before and after processing. Input devices116can include one or more devices such as a keyboard, computer mouse, etc.

Note that the following discussion provides a basic embodiment indicating how to carry out functionality associated with the mobility agent140as discussed above and below. It should be noted, however, that the actual configuration for carrying out the mobility agent140can vary depending on a respective application. For example, as previously discussed, computer system110can include one or multiple computers that carry out the processing as described herein.

In different embodiments, computer system110may be any of various types of devices, including, but not limited to, a network switch, a router, a wireless access point, a personal computer system, desktop computer, laptop, notebook, or netbook computer, mainframe computer system, handheld computer, workstation, network computer, application server, storage device, a consumer electronics device such as a camera, camcorder, set top box, mobile device, video game console, handheld video game device, or in general any type of computing or electronic device.

As shown, computer system110of the present example includes an interconnect111that couples a memory system112, a processor113, I/O interface114, and a communications interface115.

I/O interface114provides connectivity to peripheral devices such as input devices116including a computer mouse, a keyboard, a selection tool to move a cursor, display screen, etc.

Communications interface115enables the mobility agent140of computer system110to communicate over a network and, if necessary, retrieve any data required to create views, process content, communicate with a user, etc. according to embodiments herein.

As shown, memory system112is encoded with mobility agent140-1that supports functionality as discussed above and as discussed further below. Mobility agent140-1(and/or other resources as described herein) can be embodied as software code such as data and/or logic instructions that support processing functionality according to different embodiments described herein.

During operation of one embodiment, processor113accesses memory system112via the use of interconnect111in order to launch, run, execute, interpret or otherwise perform the logic instructions of the mobility agent140-1. Execution of the mobility agent140-1produces processing functionality in mobility agent process140-2. In other words, the mobility agent process140-2represents one or more portions of the mobility agent140performing within or upon the processor113in the computer system110.

It should be noted that, in addition to the mobility agent process140-2that carries out method operations as discussed herein, other embodiments herein include the mobility agent140-1itself (i.e., the un-executed or non-performing logic instructions and/or data). The mobility agent140-1may be stored on a tangible computer readable storage medium including computer readable storage media such as floppy disk, hard disk, optical medium, etc. According to other embodiments, the mobility agent140-1can also be stored in a memory type system such as in firmware, read only memory (ROM), or, as in this example, as executable code within the memory system112.

In addition to these embodiments, it should also be noted that other embodiments herein include the execution of the mobility agent140-1in processor113as the mobility agent process140-2. Thus, those skilled in the art will understand that the computer system110can include other processes and/or software and hardware components, such as an operating system that controls allocation and use of hardware resources, or multiple processors.

Those skilled in the art will understand that there can be many variations made to the operations of the user interface explained above while still achieving the same objectives of the invention. Such variations are intended to be covered by the scope of this invention. As such, the foregoing description of embodiments of the invention are not intended to be limiting. Rather, any limitations to embodiments of the invention are presented in the following claims.