Method to support multiple uplinks failover between switch interfaces with port security

Patent metadata

Field	Value
Publication number	US-12452202-B2
Application number	US-202318197487-A
Country	US
Kind code	B2
Filing date	May 15, 2023
Priority date	May 15, 2023
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

A first switch port receives a first control packet, a header having a source media access control (MAC) address of a first MAC of a first interface of a sending device and a payload containing a second MAC of a second interface of the same sending device. The first and second interfaces form a bonded interface for failover purposes on the sending device. A second switch port receives a second control packet, a header having the second MAC as its source MAC and a payload containing the first MAC. The switch associates the first and second MAC addresses as related MAC addresses associated with the bonded interface. The switch facilitates failover between the secure interfaces via multiple uplinks while maintaining the port security on the switch by allowing transmission of data from either the first or second MAC address, associated as related MAC addresses, without triggering a port security violation.

First claim

What is claimed is:

1. A method for facilitating port failover while maintaining port security at a switch, the method comprising:
receiving, by a first port of the switch, a first control packet comprising a first Link Layer Discovery Protocol Data Unit (LLDPDU),
wherein the first LLDPDU includes, in a header of the first LLDPDU a first MAC address of a first interface of a sending device as a source media access control (MAC) address,
wherein the first LLDPDU includes, in a payload of the first LLDPDU, a first organizationally specific type-length-value (TLV) field which includes a second MAC address of a second interface of the same sending device, and
wherein the first interface and the second interface form a bonded interface for failover purposes on the sending device;
receiving, by a second port of the switch, a second control packet comprising a second LLDPDU,
wherein the second LLDPDU includes, in a header of the second LLDPDU the second MAC address as its source MAC address, and
wherein the second LLDPDU includes, in a payload of the second LLDPDU, a second organizationally specific TLV field which includes the first MAC address;
associating, by the switch, the first MAC address and the second MAC address as related MAC addresses associated with the bonded interface on the sending device; and
facilitating failover between the first and second interfaces via multiple uplinks while maintaining the port security on the switch by allowing, by the switch, transmission of data from either of the first MAC address and the second MAC address, associated as related MAC addresses, without triggering a port security violation.

2. The method of claim 1 ,
wherein the payload of the first LLDPDU further contains one or more other MAC addresses of one or more other interfaces of the same sending device,
wherein the first interface, the second interface, and the one or more other interfaces form the bonded interface for failover purposes,
wherein the payload of the second LLDPDU further contains the one or more other MAC addresses, and
wherein the method further comprises:
receiving, by one or more other ports of the switch, one or more other LLDPDUs,
wherein a header of a respective other LLDPDU has a respective other MAC address as its source MAC address, and
wherein a payload of the respective other LLDPDU contains the first MAC address, the second MAC address, and all of the one or more other MAC addresses except for the source MAC address of the respective other LLDPDU;
associating, by the switch, the first MAC address, the second MAC address, and the one or more other MAC addresses as related MAC addresses associated with the bonded interface on the sending device; and
facilitating the failover between the first, second, and one or more other interfaces via multiple uplinks while maintaining the port security on the switch by allowing, by the switch, transmission of data from any of the first MAC address, the second MAC address, and the one or more other MAC addresses, associated as related MAC addresses, without triggering the port security violation.

3. The method of claim 1 , further comprising:
receiving, by the first port of the switch, data packets via the first interface; and
responsive to detecting a condition which halts transmission of the data packets to the first port via the first interface:
initiating the failover by commencing transmission of the data packets via the second interface;
receiving, by the second port of the switch, the data packets via the second interface; and
responsive to receiving the data packets via the second interface, facilitating the failover between the first and second interfaces by using the previously associated first and second MAC addresses to refrain from triggering the port security violation.

4. The method of claim 1 , further comprising eliminating a conflict between:
a redundancy mechanism of managing the uplinks between the sending device and the switch; and
the port security at the switch.

5. The method of claim 1 ,
wherein the first LLDPDU and the second LLDPDU are generated by and received from a network device comprising an access point.

6. The method of claim 1 ,
wherein associating the first MAC address and the second MAC address causes the switch to recognize the first interface and the second interface as secure interfaces bonded to the same sending device.

7. The method of claim 1 , wherein the port security violation comprises at least one of:
determining that a maximum number of secure MAC addresses have been learned on an interface of the switch and further determining that a device whose MAC address has not been previously seen on the interface attempts to access the interface;
and
determining that a MAC address learned or configured on one secure interface is subsequently seen on another secure interface in a same virtual local area network (VLAN).

8. The method of claim 1 ,
wherein the header of the first LLDPDU comprises:
a TLV type of a fixed value, which is used to indicate all organizationally defined TLVs; and
a TLV length, which is used to indicate a length of the payload of the first LLDPDU, the payload represented by an octet string; and
wherein the payload of the first LLDPDU comprises:
an organizationally unique identifier (OUI), which comprises a unique identifier field that identifies an associated organization;
an organizationally defined subtype, which comprises a vendor-specific definition that defines a new subtype to indicate subsequent MAC addresses belonging to bonded interfaces of the same device; and
an organizationally defined information string, which comprises a sequence of the MAC addresses belonging to the bonded interfaces of the same device.

9. A non-transitory computer-readable storage medium storing instructions executable by a computer to:
receive, by a first port of the switch, a first control packet comprising a first Link Layer Discovery Protocol Data Unit (LLDPDU),
wherein the first LLDPDU comprises, in a header of the first LLDPDU and as a source media access control (MAC) address, a first MAC address, a first interface of a sending device,
wherein the first LLDPDU comprises, in a payload of the first LLDPDU, a first organizationally specific type-length-value (TLV) field which includes a second MAC address of a second interface of the same sending device, and
wherein the first interface and the second interface form a bonded interface for failover purposes on the sending device;
receive, by a second port of the switch, a second control packet comprising a second LLDPDU,
wherein the second LLDPDU includes, in a header of the second LLDPDU, the second MAC address as its source MAC address, and
wherein the second LLDPDU includes, in a payload of the second LLDPDU, a second organizationally specific TLV field which includes the first MAC address;
associating, by the switch, the first MAC address and the second MAC address as related MAC addresses associated with the bonded interface on the sending device; and
facilitating failover between the first and second interfaces via multiple uplinks while maintaining the port security on the switch by allowing, by the switch, transmission of data from either of the first MAC address and the second MAC address, associated as related MAC addresses, without triggering a port security violation.

10. The non-transitory computer-readable storage medium of claim 9 ,
wherein the payload of the first LLDPDU further contains one or more other MAC addresses of one or more other interfaces of the same sending device,
wherein the first interface, the second interface, and the one or more other interfaces form the bonded in

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Xu Ke
• Ren Zhijun
• Wang Chunfeng

Classifications

• H04L69/40

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title

• H04L63/162 Primary

  at the data link layer · CPC title

• H04L2101/622

  Layer-2 addresses, e.g. medium access control [MAC] addresses · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L61/2596 Primary

  Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses · CPC title