Abstract: Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

Abstract: Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

Abstract: Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

Abstract: Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

Abstract: A system and method automatically configures the interfaces of an intermediate network device. A discovery process operating at the device detects the identity or type of network entities actually coupled to the device's interfaces. Utilizing the identity or type of detected entities, a look-up is performed to obtain a configuration macro specially defined for each detected network entity. The retrieved configuration macros are executed and applied at the respective interfaces. During operation, the intermediate network device continues to monitor the identity and type of entities actually coupled to its interfaces. If a change is detected, such as an entity moving from a first to a second interface, the specially defined configuration macro for that entity floats from the first to the second interface where it is executed and applied.

Abstract: A method of automatically establishing differentiated services quality of service treatment for a return packet flow that is associated with an originating packet flow in a network is disclosed. The originating packet flow is received, and it is determined that one or more packets in the originating packet flow are marked with a DSCP value that matches a policy rule that instruct setting of a specified DSCP value to the return packet flow. In response, information identifying the originating packet flow and a second DSCP value for marking the return packet flow is created and stored. When a corresponding return packet flow is received and determined to be associated with the originating packet flow, packets of the return packet flow are automatically marked with the second DSCP value. Once the packet flow terminates, all stored information is removed.