Patent ID: 8380819

Claim:
A computer-implemented method comprising: establishing a control channel between a first mobility switch and a second mobility switch within a mobility domain, the mobility domain providing wireless network connectivity for mobile units and wired network connectivity for static client devices, the control channel providing a connection for control messaging between the first mobility switch and the second mobility switch, the first mobility switch and the second mobility switch being network switches that process data traffic from one or more mobile units and from one or more static client devices, the first mobility switch providing connectivity for a first virtual local area network, the second mobility switch providing connectivity for a second virtual local area network; executing a security policy that controls data traffic based at least on IP (Internet Protocol) addresses of client devices attempting to connect to the mobility domain, the security policy being executed for both the first virtual local area network and for the second virtual local area network, the security policy being applied equally to both static computing devices and to mobile units; receiving an authentication request for a first mobile unit to connect to the mobility domain via the first mobility switch; adding an access control list entry to a first binding table, the first binding table being associated with the first mobility switch, the first binding table maintaining an association of source IP address to Media Access Control (MAC) address of client devices, the access control list entry indicating that the first mobile unit is authenticated for transmitting data traffic within the mobility domain via the first mobility switch; transmitting the access control list entry to a second binding table via the control channel, the second binding table being associated with the second mobility switch, the access control list entry in the second binding table indicating that the first mobile unit is authenticated for transmitting data traffic within the mobility domain via the second mobility switch; establishing a first access tunnel between the first mobility switch and a first access point device, the first access point device having a network connection to the first mobility switch, the first access point device providing wireless network connectivity to one or more mobile units; and establishing a second access tunnel between the second mobility switch and a second access point device, the second access point device having a network connection to the second mobility switch, the second access point device providing wireless network connectivity to one or more mobile units within the mobility domain.