Detecting vlan misconfiguration

Patent metadata

Field	Value
Publication number	US-2022321379-A1
Application number	US-202217808226-A
Country	US
Kind code	A1
Filing date	Jun 22, 2022
Priority date	Feb 5, 2020
Publication date	Oct 6, 2022
Grant date	—

Abstract

Disclosed are methods for detecting misconfigured VLANs. In some embodiments, traffic on a VLAN across multiple access points is categorized. Traffic on the VLAN at a single access point is then also categorized. The categorization of the VLAN traffic at the single access point can be in response to, for example, communication errors or other conditions. The two categorizations are then compared to determine if the VLAN traffic at the AP is consistent with the VLAN traffic across a network (e.g., an enterprise network). If the VLAN traffic at the AP is generally consistent with that across the network, this may indicate that a downstream network component, such as a switch or router, is misconfigured. Thus, some embodiments programmatically reconfigure the downstream component to forward traffic for the VLAN.

First claim

1 . A method, comprising:
categorizing, by one or more hardware processors, first network traffic communication between each of at least two access points (APs) of a plurality of APs and a network component over a virtual local area network (VLAN); in response to detecting, by the one or more hardware processors, one or more errors in second network traffic communication between one AP of the plurality of APs and the network component over the VLAN, categorizing the second network traffic communication between the one AP of the plurality of APs and the network component over the VLAN; in response to the categorization of the second network communication matching the categorization of the first network communication, detecting, by the one or more hardware processors, a misconfiguration of the network component; and automatically generating a notification identifying the detected misconfiguration of the network component.

2 . The method of claim 1 , further comprising, in response to detecting the misconfiguration of the network component, automatically reconfiguring the network component to mitigate the misconfiguration.

3 . The method of claim 1 , wherein detecting the misconfiguration between the one AP of the plurality of APs and the network component further includes detecting a misconfiguration of a port on the network component.

4 . The method of claim 1 , further comprising, in response to the categorization of the second network communication not matching the categorization of the first network communication, detecting, by the one or more hardware processors, a misconfiguration of the one AP of the plurality of APs; and
automatically generating a notification identifying the detected misconfiguration of the one AP of the plurality of APs.

5 . The method of claim 4 , further comprising automatically reconfiguring the one AP of the plurality of APs to mitigate the misconfiguration of the one AP of the plurality of APs.

6 . The method of claim 1 , further comprising categorizing the first network traffic communication as one of continuous traffic, intermittent traffic, site-specific traffic or unauthenticated traffic; and
categorizing the second network traffic communication as one of continuous traffic, intermittent traffic, site-specific traffic or unauthenticated traffic.

7 . The method of claim 1 , wherein categorizing the first network traffic communication further includes categorizing the first network traffic communication as unauthenticated traffic, and
wherein categorizing the second network traffic communication further includes categorizing the second network traffic communication as unauthenticated traffic, the method further comprising automatically reconfiguring a backend component to forward traffic provided by the one AP of the plurality of APs over the VLAN to a pre-assigned VLAN designated for unauthenticated wireless clients.

8 . The method of claim 1 , wherein the notification includes a recommended action including one or more of changing a cable configuration between the one AP of the plurality of APs and the network component or changing a VLAN configuration for the network component.

9 . The method of claim 1 , wherein the VLAN is a site-specific VLAN, the method further comprising determining whether a site associated with the one AP of the plurality of APs is consistent with the site-specific VLAN.

10 . A system, comprising:
hardware processing circuitry; one or more hardware memories comprising instructions that configure the hardware processing circuitry to perform operations comprising: categorizing, by one or more hardware processors, first network traffic communication between each of at least two access points (APs) of a plurality of APs and a network component over a virtual local area network (VLAN); in response to detecting, by the one or more hardware processors, one or more errors in second network traffic communication between one AP of the plurality of APs and the network component over the VLAN, categorizing the second network traffic communication between the one AP of the plurality of APs and the network component over the VLAN; in response to the categorization of the second network communication matching the categorization of the first network communication, detecting, by the one or more hardware processors, a misconfiguration of the network component; and automatically generating a notification identifying the detected misconfiguration of the network component.

11 . The system of claim 10 , further comprising, in response to detecting the misconfiguration of the network component, automatically reconfiguring the network component to mitigate the misconfiguration.

12 . The system of claim 10 , wherein detecting the misconfiguration between the one AP of the plurality of APs and the network component further includes detecting a misconfiguration of a port on the network component.

13 . The system of claim 10 , further comprising, in response to the categorization of the second network communication not matching the categorization of the first network communication, detecting, by the one or more hardware processors, a misconfiguration of the one AP of the plurality of APs; and
automatically generating a notification identifying the detected misconfiguration of the one AP of the plurality of APs.

14 . The system of claim 13 , further comprising automatically reconfiguring the one AP of the plurality of APs to mitigate the misconfiguration of the one AP of the plurality of APs.

15 . The system of claim 10 , further comprising categorizing the first network traffic communication as one of continuous traffic, intermittent traffic, site-specific traffic or unauthenticated traffic; and
categorizing the second network traffic communication as one of continuous traffic, intermittent traffic, site-specific traffic or unauthenticated traffic.

16 . The system of claim 10 , wherein categorizing the first network traffic communication further includes categorizing the first network traffic communication as unauthenticated traffic, and
wherein categorizing the second network traffic communication further includes categorizing the second network traffic communication as unauthenticated traffic, the method further comprising automatically reconfiguring a backend component to forward traffic provided by the one AP of the plurality of APs over the VLAN to a pre-assigned VLAN designated for unauthenticated wireless clients.

17 . The system of claim 10 , wherein the notification includes a recommended action including one or more of changing a cable configuration between the one AP of the plurality of APs and the network component or changing a VLAN configuration for the network component.

18 . The system of claim 10 , wherein the VLAN is a site-specific VLAN, the method further comprising determining whether a site associated with the one AP of the plurality of APs is consistent with the site-specific VLAN.

19 . The system of claim 10 , wherein the at least two APs of the plurality of APs include the one AP of the plurality of APs.

20 . A non-transitory computer-readable storage medium comprising instructions that when executed configure hardware processing circuitry to perform operations comprising:
categorizing, by one or more hardware processors, first network traffic communication between each of at least two access points (APs) of a plurality of APs and a network component over a virtual local area network (VLAN); in response to detecting, by

Assignees

• Juniper Networks Inc

Inventors

• Wang Jisheng

Classifications

• H04L12/4641 Primary

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L43/087

  Jitter · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title

• H04L12/46

  Interconnection of networks · CPC title

• H04L41/26

  using dedicated tools for LAN [Local Area Network] management · CPC title