Fault tolerant wireless access system and method

A fault tolerant wireless system and method is disclosed that provides redundancy against a data center failure. Wireless connections are routed to a switch at a primary data center and forwarded through a gateway router, also located at the primary data center, to the internet. A backup switch and backup gateway router provides redundancy and are located at a backup data center geographically separate from the primary data center. The backup switch and backup gateway router provides an alternate path to the internet if the primary path fails. Both the primary switch and backup switch are assigned to the same subnet but the backup switch is advertised with an offset to favor routes through the primary switch.

BACKGROUND OF THE INVENTION

The present invention relates to communication networks. More specifically, the invention relates to fault tolerant wireless networks.

Many companies, both large and small, offer guest internet access through the company's network. This allows visitors to conveniently access their own company's network through the internet. Guest wireless internet access provides greater convenience by allowing the visitor to access the internet without the bother of physically connecting to the company's network.

Allowing non-employees access to a company's network, however, creates a security risk because the guest access may be used as an entry point into the company's network. Furthermore, guest internet access is usually viewed as a non-critical system that does not require the redundant failover systems associated with the company's “critical” computer systems. Therefore, there remains a need for a fault tolerant wireless access system.

SUMMARY OF THE INVENTION

A fault tolerant wireless system and method is disclosed that provides redundancy against a data center failure. Wireless connections are routed to a switch at a primary data center and forwarded through a gateway router, also located at the primary data center, to the internet. A secondary switch and secondary gateway router provides redundancy and are located at a secondary data center geographically separate from the primary data center. The secondary switch and secondary gateway router provides an alternate route to the internet if the primary route fails. Both the primary switch and secondary switch are assigned to the same subnet but the secondary switch is advertised with an offset to favor routes through the primary switch.

One embodiment of the present invention is directed to system comprising: a primary route for handling wireless traffic between an internet and an intranet, the primary route including a primary gateway router connected to the internet and a primary switch configured to aggregate and direct wireless traffic on the intranet, the primary gateway router and primary switch located at a first data center; and a secondary route providing a redundant route between the internet and the intranet, the secondary route including a secondary gateway router connected to the internet and a secondary switch configured to aggregate and direct wireless traffic on the intranet, the secondary gateway router and secondary switch located at a second data center geographically separate from the first data center, wherein the primary switch and secondary switch are on a same subnet and exchange keep-alive messages with each other. In one aspect, the system further comprises an access manager connected between the primary gateway router and the primary switch, the access manager allowing access to the internet to only an authorized guest. In another aspect, the primary gateway router and primary switch maintain communication with each other using a routing protocol, the primary switch automatically routing the wireless traffic to the secondary switch when communication between the primary gateway router and the primary switch is broken. In another aspect, the primary switch advertises an IP address with a first offset and the secondary switch advertises the same IP address with a second offset, the first and second offsets selected to route wireless traffic to the primary switch.

Another embodiment of the present invention is directed to a method of providing fault tolerant wireless access to an internet, the method comprising: providing a primary switch located at a first data center, the primary switch configured to route wireless traffic to the internet through a first route; and providing a secondary switch located at a second data center separate from the first data center, the secondary switch configured to route wireless traffic to the internet through a second route when a break occurs in the first route.

Another embodiment of the present invention is directed to a method of wirelessly accessing an internet at a site, the method comprising: receiving an access code; connecting to a wireless network using the access code, the wireless network connected to the internet; and transmitting messages to the internet, the messages routed through a primary wireless switch located at a primary data center, the primary wireless switch routing the messages to the internet along a primary route, wherein a secondary wireless switch located at a secondary data center separate from the first data center automatically routes the messages through a secondary route when a break occurs in the primary route.

DETAILED DESCRIPTION

FIG. 1is a diagram illustrating an embodiment of the present invention. InFIG. 1, a primary path through a primary data center101connects a company's intranet105to the internet100. An alternate path to the internet100is provided at a secondary data center102that is preferably geographically separated from the primary data center101to provide failover redundancy at the data center level.

Each data center101102includes a gateway router110115that connects to the internet100. Gateway router is connected to the company's external firewall120125. An access manager130135sits in the company's DMZ between the external firewall120125and an internal firewall140145. The access manager130135controls access to the Internet for outgoing packets. In the primary data center101, a primary switch150is connected between the internal firewall140and the company's intranet105. At the secondary data center102, a secondary switch155is connected between the secondary data center's internal firewall145and the company's intranet105.

An access point160allows local wireless access to the internet100. InFIG. 1, several access points160are preferably distributed throughout the company's premises to provide sufficient wireless coverage from anywhere within the company. Each access point routes the received wireless messages to the primary switch150but can route the messages to the secondary switch, shown as a dashed line inFIG. 1, if the primary switch fails.

The primary and secondary switches communicate with each other via a redundancy subnet190and a utility subnet195. The redundancy subnet carries the wireless traffic between the primary and secondary switches. The utility subnet carries status and administrative information exchanged between the two switches.

In a preferred embodiment, a keep-alive message is repeatedly exchanged between the switches at a predetermined time interval. The keep-alive message allows each switch to monitor the status of the other switch and take an appropriate action when the required. For example, if the primary switch fails, the secondary switch will experience a break in the keep-alive exchange and can take the appropriate action.

The gateway router110and primary switch150can monitor the route between them by exchanging messages with each other using a routing protocol such as, for example, border gateway protocol (BGP) or other common protocols used in the art. Usually, firewalls120140and the access manager130are not configured to communicate with each other using BGP so the status of the route to the internet cannot be easily determined. The gateway router and primary switch, however, communicate with each other using BGP and a failure of the firewall or access manager breaks the communication between the gateway router and primary switch. If such a break occurs, the primary switch can reroute the internet-bound packets to the secondary switch through the redundancy subnet190. The failover to the redundancy subnet is expected to be fast as each switch maintains a list of alternate next-hop devices for internet-bound traffic and can quickly redirect internet-bound traffic to the secondary switch if a break between the gateway router110and primary switch150is detected.

At the secondary data center, gateway router115, external firewall125, access manager135, internal firewall145, and secondary switch155provide an alternate route for internet-bound wireless messages and provide device-level redundancy for the system. Monitoring of the alternate route to the internet between the secondary switch155and gateway router115may follow the same method as described for the primary route.

FIG. 2is a diagram illustrating generation, transmission, and storage of access codes in an embodiment of the present invention wherein components identical to those shown inFIG. 1are identified by the same reference number. InFIG. 2, a guest receives an access code after registering at a security front desk of the visited site along with the guest network's SSID and instructions on accessing the guest network. Each security front desk can enter registration information about the guest and request an access code that allows the guest to wirelessly access the internet from locations within the visited site. Registration information is entered into a console210that generates the access code for the guest. The console210provides an interface to a guest-net application executing on one of a plurality of web and database servers220located at the primary data center101. The access codes generated by the console210are pushed to an access-code database230for storage. The application also transmits the generated access codes to a secondary access-code database225located in the secondary data center. The access codes are pushed to the access manager at both the primary and secondary data centers. In a preferred embodiment, access codes pushed to the access manager use a secure connection such as, for example, SSL. InFIG. 2, redundant paths are shown in dashed lines and mirror the primary paths followed by the access codes. In a backup scenario, console210may be provided by a guest-net application executing on one of a plurality of web and database servers225located at the secondary data center102. The generated access codes are pushed to both access-code databases230235and are also pushed to both access managers120125from the secondary web/database server225.

The guest uses his/her wireless device such as, for example, a laptop or PDA to access the internet through the company's guest network. The wireless device connects to an access point and is routed to the wireless switch. In a preferred embodiment, the access point is a Cisco 1200 series access point and the wireless switch is a Cisco series 6500 wireless switch, both available from Cisco Systems, Inc. of San Jose, Calif. The access point routes the guest wireless traffic to the primary switch by having the primary and secondary switch advertise the same IP address but with a different offset such that the primary switch is favored over the secondary switch. The primary switch forwards the guest wireless traffic to the gateway router through the access manager. The access manager prompts the guest for the access code and compares the entered access code against the access-code database. If the entered access code is authorized to access the internet, the access manager passes the wireless traffic to the gateway router. If the access code is not authorized to access the internet, the wireless traffic is blocked and not sent to the gateway router. In a preferred embodiment, the access manager is a database appliance such as, for example, the building broadband service manager (BBSM) appliance available from Cisco Systems, Inc.

In a preferred embodiment, the gateway router in the primary data center originates a static VRF default route toward the ISP's serial interface IP address. The use of a VRF creates a separate logical routing table so that the wireless default routing does not interfere with the company's employee Internet routing. The primary data center is the preferred datacenter for guest wireless access to the Internet and considered primary. Multi-protocol BGP passes the VRF vendor default to the internal wireless switches. Multi-protocol BGP also logically connects the guest-net inter-datacenter routing domain between the two wireless switches. Because of multi-protocol BGP route propagation, all of the wireless switches in the VRF vendor routing domain learn the VRF vendor default route dynamically.

If the access manager or firewalls fail, the multi-protocol BGP peering between the external primary gateway router and the primary wireless switch breaks thereby removing the dynamically passed VRF vendor default route from the VRF routing domain.

Once the VRF vendor dynamic default disappears, a mechanism has to be in place to make sure that guest traffic destined for the primary wireless switch can traverse the inter-datacenter VRF connection and utilize the backup DMZ without having to fail the entire primary wireless switch over. To accomplish this failover, a “floating” VRF vendor static default route activates the instant the primary dynamic default route disappears, for whatever reason. The floating static default route is characterized by an offset that indicates the prefer ability of this route against other protocols that might also be advertising the route. Both datacenter's wireless switches utilize this type of static route to forward traffic to the backup guest DMZ in the event of dynamic routing failure.

The description herein should be understood to describe only one preferred embodiment of the invention. Those skilled in the art will recognize, for example, that the described embodiment is just one simplified example of the novel system and method for fault tolerant wireless access. The simplified example is all that needs to be described in detail in order to enable the more general system and method that the invention comprises.

Embodiments of the present invention comprise computer components and computer-implemented steps that will be apparent to those skilled in the art. For example, it should be understood by one of skill in the art that the computer-implemented steps may be stored as computer-executable instructions on a computer-readable medium such as, for example, floppy disks, hard disks, optical disks, Flash ROMS, nonvolatile ROM, and RAM. For ease of exposition, not every step or element of the present invention is described herein as part of a computer system, but those skilled in the art will recognize that each step or element may have a corresponding computer system or software component. Such computer system and/or software components are therefore enabled by describing their corresponding steps or elements (that is, their functionality), and are within the scope of the present invention.

Having thus described at least illustrative embodiments of the invention, various modifications and improvements will readily occur to those skilled in the art and are intended to be within the scope of the invention. Accordingly, the foregoing description is by way of example only and is not intended as limiting. The invention is limited only as defined in the following claims and the equivalents thereto.