Patent ID: 7962954

Claim:
An apparatus, comprising: a network interface that is capable of being coupled to a data network for sending or receiving one or more packet flows therefrom; one or more processors; one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to perform: maintaining as open a port of a network switch in conformity with an authentication protocol in response to granting to a first host access to a particular network; receiving a network frame on the port of the network switch from a second host that is attempting to access the particular network, wherein the network frame is not transmitted to the particular network until the network switch determines that transmission of network frames from the second host is authorized; while maintaining as open the port of the network switch and while permitting network frames sent from the first host received on the port to be transmitted to the particular network, the network switch determining whether the port is associated with information that is necessary for the network switch to determine locally whether the transmission of network frames from the second host is authorized, if the port is locally associated with the necessary information, then the network switch determining locally whether the transmission of network frames from the second host is authorized, if the port is not locally associated with the necessary information, then the network switch obtaining the necessary information from an authentication server, and associating the necessary information with the port, the network switch determining locally, based on information locally associated with the port, that the second host is authorized to transmit network frames to the particular network, and the network switch permitting network frames sent from the second host received on the port to be transmitted to the particular network.