Abstract: In one embodiment, longest prefix matching (LPM) operations are performed on a value in multiple interspersed prefix length search spaces to determine an overall longest prefix matching result in a packet switching system. A first LPM lookup unit performs a first LPM operation on the particular lookup value in a first search space finding a first longest matching prefix, and a second LPM lookup unit performs a second LPM operation on the particular lookup value in a second search space finding a second longest matching prefix. The longer of the first and second longest matching prefixes determines the overall LPM. In one embodiment, the first search space and the second search space include non-default route prefixes with interspersed prefix lengths matching a same value, such as, but not limited to the particular lookup value (e.g., a destination address of a packet).

Abstract: In one embodiment, longest prefix matching (LPM) operations are performed on a value in multiple interspersed prefix length search spaces to determine an overall longest prefix matching result in a packet switching system. A first LPM lookup unit performs a first LPM operation on the particular lookup value in a first search space finding a first longest matching prefix, and a second LPM lookup unit performs a second LPM operation on the particular lookup value in a second search space finding a second longest matching prefix. The longer of the first and second longest matching prefixes determines the overall LPM. In one embodiment, the first search space and the second search space include non-default route prefixes with interspersed prefix lengths matching a same value, such as, but not limited to the particular lookup value (e.g., a destination address of a packet).

Abstract: Embodiments generally provide techniques for mapping service modules on a network device. Embodiments identify a plurality of service modules, each configured to perform a respective service. A first one of the plurality of service modules is mapped to a first one of a plurality of virtual switches on the network device. Service policy information for a plurality of virtual switches is retrieved. The service policy information is indicative of service requirements for each of the plurality of virtual switches. Upon detecting an occurrence of a predefined event, embodiments determine a second one of the plurality of virtual switches to map the first service module to, based on the service policy information. The first service module is then mapped to the second virtual switch.

Abstract: Embodiments generally provide techniques for mapping service modules on a network device. Embodiments identify a plurality of service modules, each configured to perform a respective service. A first one of the plurality of service modules is mapped to a first one of a plurality of virtual switches on the network device. Service policy information for a plurality of virtual switches is retrieved. The service policy information is indicative of service requirements for each of the plurality of virtual switches. Upon detecting an occurrence of a predefined event, embodiments determine a second one of the plurality of virtual switches to map the first service module to, based on the service policy information. The first service module is then mapped to the second virtual switch.

Abstract: A technique optimizes the distribution of authenticated users among a plurality of broadcast domains, such as virtual local area networks (VLAN). Users are dynamically assigned to different broadcast domains based on various factors, including but not limited to the number of authenticated users already participating in each broadcast domain, the available bandwidth in each broadcast domain, user classes associated with users participating in each broadcast domain, etc. Based on one or more of these factors, authenticated users are optimally distributed (“load balanced”) among the plurality of broadcast domains, thereby reducing the amount of broadcast traffic and configuration within each domain.

Abstract: Configuring an interface of a switch includes sending an authentication request requesting authentication for an endpoint from a switch to an authentication server. The switch comprises interfaces and is operable to access templates, where a template is operable to generate one or more interface commands for an interface. An instruction is received from the authentication server. The instruction instructs the switch to apply an identified template to an interface, where the identified template is identified by the authentication server as associated with the endpoint. The identified template is applied to configure the interface according to the instruction.

Abstract: Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for policy-based processing of packets, including mechanisms for managing the policies. A user is authenticated and its user group identifier is identified. A packet is received and is associated with the user group identifier, and one or more fields (typically other than the source address field) of the packet are used to identify a second group identifier. A lookup operation is then performed on a policy based on the first and second group identifiers to identify a packet processing action to be performed on the packet. These identifiers are typically not network addresses, which disassociates the policy from physical network addresses (which often are dynamically assigned and may also vary based on the access point into the network of a user), and allows a switching device to process packets based on a policy stated using group identifiers.

Abstract: A common security database is maintained by a RADIUS server based on the attributes the RADIUS server receives through accounting packets. When the common security database has conflicting entries, for example a MAC address and/or IP address appearing at two different network devices such as switches or routers, the RADIUS server can notify the associated network access devices to take corrective action.