Abstract: A communication system comprises: a physical machine; a switch control apparatus that controls a physical switch connected to the physical machine; and a virtual network management apparatus that manages a virtual network using the physical switch and at least one of the physical machine and a virtual machine operating on the physical machine. The physical machine comprises: a port information collection unit that collects port information of a NIC (Network Interface Card) assigned to the virtual network; and a port information notification unit that notifies the virtual network management apparatus of a correspondence between the NIC and the collected port information. The virtual network management apparatus instructs the switch control apparatus so that the physical switch uses the port information as a match condition.

Abstract: An LP table retains a combination of a physical port and a VLAN identifier in association with a logical port. When a frame is received at the physical port, a table processing unit acquires a logical port based on the LP table. An FDB processing unit learns a source MAC address contained in the received frame in association with the logical port acquired by the table processing unit to an FDB. A plurality of logical ports are set for the physical port by the LP table. A loop prevention unit prohibits frame relay between the plurality of logical ports set for the physical port.

Abstract: Embodiments of the present invention provide a label distribution method and device. A first routing device sends a first BGP update message including a first VPN instance identifier and a first RT to a second routing device. The first routing device receives a second BGP update message including a second VPN instance identifier and a second RT. The first routing device allocates a first VPN instance label to a second VPN instance after the second routing device determines that the first RT is equal to the second RT. The first routing device sends a third BGP update message including the first VPN instance label to the second routing device.

Abstract: At least one application is received from a user. The at least one application is stored on a communication platform. A catalog is received. The catalog includes at least one service. Each service of the at least one service is associated with a platform. An indication of a selection, from the user, is received. The selection comprises a first service associated with a first platform, and a second service associated with a second platform. The first service stores the at least one application from the user. The second service runs the at least one application from the user. Responsive to receiving the indication, the at least one application is deployed to the indicated first platform. Additionally, responsive to receiving the indication, a service bridge from the communication platform to the second platform is deployed. The at least one application is run, on the first platform utilizing the service bridge.

Abstract: Systems, methods, and non-transitory computer-readable storage media for translating source addresses in an overlay network. An access switch in an overlay network, such as a VXLAN, may receive an encapsulated packet from a tunnel endpoint in the overlay network. The encapsulated packet may originate from a host associated with the tunnel endpoint and be encapsulated at the tunnel endpoint with a first source tunnel endpoint address and a destination tunnel endpoint address. The access switch may replace the first source tunnel endpoint address in the encapsulated packet with a second source tunnel endpoint address of the access switch to yield a translated packet. The access switch may then transmit the translated packet towards the destination tunnel endpoint address.

Abstract: Provided are a method and device for implementing hierarchical virtual private LAN service, the method comprising: acquiring the group attribute information of at least one remote provider edge (PE), each group attribute information carrying a group identifier of the corresponding remote PE; according to the group identifier of each PE, determining a pseudo wire (PW) group where a PW between PEs belongs, the PW group comprising a horizontal split group or a redundancy protection group; according to the PW group, determining a service forwarding path, thus solving the problem of a complex configuration process and high cost in the implementation of HVPLS via BGP-AD; in addition, when a network topology changes, the PW between the remote PEs is automatically added to the corresponding horizontal split group or the redundancy protection group without any configuration change or static addition, that is, without manual configuration.

Abstract: A communication protocol includes one or more messages passed between Web routers over a reliable transmission protocol used for inter-Web router communication. These messages include information that allows the Web routers to dynamically update mappings of client addresses or address ranges to information object repository addresses based on client-to-server distance and server load. The mappings are preferably optimal mappings of the client addresses or address ranges to the information object repository addresses and the messages report updated distances from these information object repository addresses to the client addresses or address ranges. For example, the messages may report, for each updated distance, an associated client address or address range and/or an associated anchor address of a Web router co-located with an information object repository that is the subject of the message.

Abstract: Systems, methods, and computer-readable media for flushing of Customer Media Access Control (C-MAC) addresses in a PBB-EVPN network are disclosed. A first provider edge (PE) device can maintain a plurality of service instances configured on a first interface. The first PE device can detect at least one failed ethernet virtual circuit (EVC) on the first interface and identify at least one service instance from the plurality of service instances that is associated with the at least one failed EVC. The PE device can send, to a second PE device, a C-MAC flush notification message that identifies the at least one service instance and the message can cause the second PE device to remove C-MAC addresses corresponding to the at least one service instance and the B-MAC address for the first interface.

Abstract: Techniques are described for automatic provisioning of virtual local area networks (VLANs) on server-facing ports of access switches included in a data center network. Conventionally, VLANs are pre-configured on all server-facing ports of access switches. The techniques described in this disclosure enable automatic provisioning of VLANs on server-facing ports of access switches triggered by traffic received on the ports. The techniques include a feature in a forwarding plane of an access switch that is configured to detect data packets received for an unknown VLAN on a port, and notify a control plane of the access switch of the unknown VLAN on the port. In response to the notification from the forwarding plane, the control plane may authorize and provision the VLAN on the port. The techniques described in this disclosure include hardware-assisted software provisioning of an unknown VLAN on a given port of an access switch.

Abstract: Methods and techniques for flooding packets on a per-virtual-network basis are described. Some embodiments provide a method (e.g., a switch) which determines an internal virtual network identifier based on one or more fields in a packet's header. Next, the method performs a forwarding lookup operation based on the internal virtual network identifier. If the forwarding lookup operation succeeds, the method can process and forward the packet accordingly. However, if the forwarding lookup operation fails, the method can determine a set of egress ports based on the internal virtual network identifier. Next, for each egress port in the set of egress ports, the method can flood the packet if a virtual network identifier in the packet's header is associated with the egress port. Flooding packets on a per-virtual-network basis can substantially reduce the amount of resources required to flood the packet when a forwarding lookup operation fails.

Abstract: Embodiments of the invention relate to providing virtual network domain movement operations for overlay networks. One embodiment includes a method that includes determining one or more overlay network attributes (ONAs) for a plurality of virtual networks. The one or more ONAs are associated with the virtual networks. The one or more ONAs are managed as one or more portable entities by one or more of creating ONAs, deleting ONAs, moving ONAs, combining ONAs and dividing ONAs. A movement operation is performed on the one or more virtual networks among one or more servers of one or more overlay networks based on the management of the one or more ONAs.

Abstract: A method for forwarding a packet by a first Network Virtualization Edge (NVE) in Network Virtualization Overlays, Layer 3 (NVO3) and an NVE is provided. The method comprises, in response to receiving an IP packet from a first Virtual Access Point (VAP) of the first NVE, looking up forwarding information to obtain an IP address of a second NVE; in response to lookup fails, or the IP address of the second NVE being different from an IP address of the or the second VAP being different from the first VAP, dropping the IP packet; and in response to the IP address of the second NVE being the same as an IP address of the first NVE and the second VAP being the same as the first VAP, forwarding the IP packet.

Abstract: A management device allocates a first identifier that identifies, from among tenants included in a multi-tenant system, a tenant that uses virtual machines running on the multi-tenant system. The management device performs the following process, for each terminating device, from among tenants in the multi-tenant system, on virtual machines that are running on a second network in which terminating devices are installed. Specifically, the management device allocates a second identifier that identifies a tenant that uses virtual machines running on the multi-tenant system. Furthermore, the management device creates, for each terminating device, conversion information in which the first identifier that is allocated to each of the virtual machines is associated with the second identifier. Then, the management device sets each terminating device such that a packet is encapsulated in accordance with the created conversion information.

Abstract: A method of monitoring virtualized network includes receiving information regarding the virtualized network, wherein the information is received at a port of a network switch appliance, receiving a packet at a network port of the network switch appliance, and using the received information to determine whether to process the packet according to a first packet processing scheme or a second packet processing scheme, wherein the first packet processing scheme involves performing header stripping, and performing packet transmission to one of a plurality of instrument ports at the network switch appliance after the header stripping, each of the instrument ports configured for communicatively coupling to a network monitoring instrument, and wherein the second packet processing scheme involves performing packet transmission to one of the plurality of instrument ports at the network switch appliance without performing any header stripping.

Abstract: A receiving node receives a virtual LDP initialization (vInit) message from a first node, where the vInit message comprises a request to establish a vLDP session between a requesting node and a target node. If the receiving node does not own a destination address of the vInit message, the receiving node is determined to be a relay node. The relay node inserts a relay label into the vInit message, where the relay label is an outgoing label that the relay node uses to reach the first node, and forwards the vInit message toward the destination address. If the receiving node owns the destination address, the receiving node is determined to be the target node, which extracts a stack of relay labels from the vInit message. The relay labels are used to define a return path to the requesting node for messages transmitted over the vLDP session.

Abstract: A VPN implementation method and a PE device are provided. The method includes: sending VPN topology information of a local end to a PE device at a peer end, and receiving VPN topology information of the peer end sent by the PE device at the peer end; enabling, according to the VPN topology information of the local end and the VPN topology information of the peer end, the local end and the peer end to select a jointly supported topology; and connecting VPN members by using the jointly supported topology, so as to implement the VPN. A VPN in a multi-topology environment may be implemented, and service quality of a multi-topology VPN may be improved.

Abstract: Methods and computing systems for tunneling in a carrier transport network are described. An Internet Protocol (IP) packet having a destination IP address of a destination cellular site of a cellular cluster is received. A frame is formed with the IP packet placed into a payload portion of the frame. An outer Virtual Local Area Network (VLAN) tag that identifies a network of the cellular cluster to a first carrier network is added to the frame, and an inner VLAN tag that identifies the network of the cellular cluster to a second carrier is added. The first carrier network and the second carrier network are coupled via at least one network-to-network interface. The frame, including the IP packet, is forwarded to a provider edge switch of the first carrier network.

Abstract: A packet-switched, fault-tolerant, vehicle communication internetwork (100, 400, 500) comprising port-based VLANs. Two or more VLANs are embodied where a source node (110, 410, 510,610) comprises two or more network interface circuits (130,140, 415,425, 515,525, 630,640), and where looping is precluded via specific VLAN tagging and switch ports (131-134, 200, 300, 420, 430, 435, 445, 455, 465, 535, 540, 545, 560, 575, 585, associated with at least one specific VLAN. A destination node (120, 440, 450, 460, 570, 580, 590, 620) may feedback packets to the source node via a general VLAN tag along pathways associated with the two or more specific outgoing VLAN tags.

Abstract: A method of communication in a satellite network including a hub, a satellite, a remote terminal, an upstream switch connected to the hub, at least one upstream communication device connected to the upstream switch, and plural remote-connected communication devices connected to the remote terminal, is disclosed.

Abstract: In general, techniques are described for defining an interface to a network router software infrastructure that allows developers to dynamically extend a routing protocol executed by the network router to distribute data throughout the routing domain for use with custom applications. In some examples, a routing protocol process executing on a control plane of a network device may expose an interface, such as an Application Programming Interface (API), that defines methods and parameters for extending the operation of a routing protocol executed by the routing protocol process.

Abstract: A method, an apparatus, and a computer program product for wireless communication are provided. The apparatus receives information from a serving base station and at least one neighboring base station. The information indicates a time allocation of discovery resources allocated by each of the serving base station and the at least one neighboring base station for performing direct discovery. The apparatus further determines a subframe timing of the serving base station and the at least one neighboring base station, and performs direct discovery using the time allocation of the discovery resources allocated by each of the serving base station and the at least one neighboring base station based on a determined subframe timing of the serving base station or a neighboring base station corresponding to the discovery resources.

Abstract: A secure virtual network platform connects two or more subnets in different or separate network domains. The secure virtual network can use the under layer physical networks in various domains as an IP forwarding fabric without changing any existing firewalls, security settings, or network topology. A first type of connection across the virtual network involves connecting server groups. A second type of connection across the virtual network involves connecting a server group to a physical network. A third type of connection across the virtual network involves connecting a physical network to another physical network.

Abstract: A networked system includes a plurality of information handling systems (IHSs). A networking device couples the plurality of IHSs to a network. The networking device is operable to receive a packet associated with a first network application from a first IHS of the plurality of IHSs. The networking device then determines that a first virtual port is associated with the first network application in a database. The networking device then assign packets received from the first IHS and associated with the first network application to the first virtual port. The networking device then forwards packets received from the first IHS and associated with the first network application over the network using the first virtual port. The first virtual port provides access to a virtual network that is provided for the first network application and configured using network information associated with the first network application.

Abstract: Communication network systems are disclosed. In one or more implementations, the communication network system includes a plurality of network devices. Each of the plurality of network devices incorporates one or more multi-port switches, where each multi-port switch includes a connection to the network device incorporating the multi-port switch and a connection to at least one other port of another multi-port switch incorporated by another respective one of the plurality of network devices.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to facilitate end-user defined policy management. An example apparatus includes an edge node interface to detect addition of a networked user device to a service gateway, and to extract publish information from the networked user device. The example apparatus also includes a device context manager to identify tag parameters based on the publish information from the networked user device, and a tag manager to prohibit unauthorized disclosure of the networked user device by setting values of the tag parameters based on a user profile associated with a type of the networked user device.

Abstract: Techniques are presented herein to facilitate latency measurements in a networking environment. A first network device receives a packet for transport within a network domain that comprises a plurality of network devices. The plurality of network devices have a common time reference, that is, they are time synchronized. The first network device generates timestamp information indicating time of arrival of the packet at the first network device. The first network device inserts into the packet a tag that comprises at least a first subfield and a second subfield. The first subfield comprising a type indicator to signify to other network devices in the network domain that the tag includes timestamp information, and the second subfield includes the timestamp information. The first network device sends the packet from to into the network domain to another network device. Other network devices which receive that packet can make latency measurements.

Abstract: A method for improving the operations and efficiency of virtual machine management. In one embodiment, the method includes storing identification information of a user and a first computer executing software that is related to a virtual machine. Next, a third computer that is already executing software of a target user is identified. And finally, a second computer transmits, to the third computer, broadcast data corresponding to the software of the target user.

Abstract: At least one application is received from a user. The at least one application is stored on a communication platform. A catalog is received. The catalog includes at least one service. Each service of the at least one service is associated with a platform. An indication of a selection, from the user, is received. The selection comprises a first service associated with a first platform, and a second service associated with a second platform. The first service stores the at least one application from the user. The second service runs the at least one application from the user. Responsive to receiving the indication, the at least one application is deployed to the indicated first platform. Additionally, responsive to receiving the indication, a service bridge from the communication platform to the second platform is deployed. The at least one application is run, on the first platform utilizing the service bridge.

Abstract: Machines, systems and methods for data transmission in a data communications network are provided. The method comprises receiving a data packet for transmission, the data packet having a first header portion and a second header portion, wherein the first header portion comprises an identifier indicating that any information in the first header portion is not to be used; and determining destination information comprising at least a physical address of a destination in the data communications network to which the data packet is to be transmitted based on information included in the second header portion.

Abstract: Described herein are techniques for providing a virtual Wi-Fi service using internet protocol (IP) connections between a central Wi-Fi access gateway (WAG) and one or more radio nodes. The WAG establishes an IP connection with a first radio node across a network, where the first radio node is configured to connect to one or more Wi-Fi devices located near the first radio node. The WAG receives network traffic over the IP connection, where the network traffic is associated with a Wi-Fi device from the one or more Wi-Fi devices connected to the first radio node. The WAG provides a virtual Wi-Fi service through the network to the Wi-Fi device based on the network traffic such that the Wi-Fi device connects to the virtual Wi-Fi service as if the virtual Wi-Fi service is a physical device locally connected to the first radio node.

Abstract: Provided is a system and method for a multi-tenant datacenter with layer 2 cloud interconnection. More specifically the multi-tenant datacenter includes a plurality of physical client systems in a first datacenter each physical client system having a set of physical infrastructure resources. A first cloud computing environment is also in the first datacenter, and coupled to the physical client systems by OSI Layer 2. The first cloud computing environment thereby virtually extending the physical infrastructure resources of each physical client system. An associated method of providing a multi-tenant datacenter with layer 2 cloud interconnection is also provided.

Abstract: A device, of a cloud computing environment, includes a virtual network device that receives a packet with an address, and determines whether the packet is a broadcast packet or a unicast packet. The virtual network device processes the packet based on whether the packet is a broadcast packet or a unicast packet. The packet is transmitted to local address(es) or remote address(es) when the packet is a broadcast packet. The local address(es) is associated with at least one hardware component of the device, and the remote address(es) is associated with at least one other device, of the cloud computing environment, that is separate from the device. The packet is transmitted based on whether the address, of the packet, matches the local address(es) or the remote address(es) when the packet is a unicast packet.

Abstract: One embodiment of the present invention provides a switch in a network of interconnected switches. The switch includes a forwarding domain apparatus and a forwarding apparatus. The forwarding domain apparatus maintains a mapping between a first virtual local area network (VLAN) identifier and a first global VLAN identifier in a local storage device. The global VLAN identifier represents a layer-2 forwarding domain in the network and is distinct from a customer VLAN or a service-provider VLAN. The mapping is independent of a type of the VLAN identifier. During operation, the forwarding apparatus encapsulates a first packet belonging to the first VLAN in a network encapsulation header. The encapsulated packet is forwardable in the network based on the network encapsulation header. The forwarding apparatus includes the first global VLAN identifier in the network encapsulation header of the first packet.

Abstract: The present disclosure includes: a first channel unit configured to transmit and receive a data piece with a network bus, to convert the received data piece to an MII data piece, and to transmit and receive the converted MII data piece; a second channel unit configured to transmit and receive a data piece with the network bus, to convert the received data piece to an MII data piece, and to transmit and receive the converted MII data piece; a CPU configured to recognize a carrier detection signal (CRC) of the MII data received from the first channel unit and the second channel unit, and to transmit and receive the MII data; and a monitoring unit configured to perform a data communication with the CPU, and to monitor a data piece by each channel from the MII data received from the CPU.

Abstract: A packet forwarding method and system. A first network device encapsulates a to-be-forwarded packet as a first packet, and sends the first packet to a second network device, where the first packet carries a destination Media Access Control (MAC) address encapsulation instruction, the destination MAC address encapsulation instruction is used to instruct the second network device to encapsulate a destination MAC address for the first packet, the to-be-forwarded packet carries a destination internet protocol (IP) address, and the destination MAC address is a MAC address of a destination host corresponding to the destination IP address; the second network device generates a second packet containing the destination MAC address according to the destination MAC address encapsulation instruction carried by the received first packet, and forwards the second packet to the destination host corresponding to the destination MAC address.

Abstract: In a communication network including a plurality of network domains in which switches and controllers are separated, in controllers providing the information to which neighbor switches are to forward data packets, inter-domain communication is introduced. For example, a local controller alerts another local controller enabling this other local controller to perform process steps in preparation of arrival of a data packet prior to that data packet arriving at its network domain.

Abstract: A disclosed switch includes: a first applying unit that applies a setting of a virtual subnetwork to a first port that is connected to an external apparatus, upon detecting an instruction to apply the setting to the first port; and a second applying unit that applies, upon detecting that the setting was applied to the first port in the switch or other switches, the setting to a second port that is connected to an external network and is associated with the first port in advance.

Abstract: The present invention discloses a service configuration method, apparatus and system. The provided method includes steps as follows: configuring a VLAN ID of a port on an intermediate device according to preset configuration information, where the port is connected to a client; after a DHCP request message which is from the client through the intermediate device is received, obtaining a MAC address in the DHCP request message, and obtaining an IP address corresponding to the MAC address from the configuration information; and sending a response message carrying the IP address and the VLAN ID to the client through the intermediate device, so that the client sets a local virtual local area network identifier to the VLAN ID and sets a local IP address to the IP address after receiving the response message.

Abstract: A method and an apparatus for controlling communication connection in an electronic device are provided. The method includes detecting at least one peripheral, detecting at least one preference device among the at least one detected peripheral, and inactivating a communication module when at least one preference device is not detected among the at least one detected peripheral.

Abstract: An example method embodiment for networking includes managing, by a network controller, network services for one or more network devices connected to the network controller. Managing network services includes receiving a packet in a traffic flow from a network device. The network device is one of the one or more network devices connected to the network controller. Managing network services further includes determining applicable services for the packet, transmitting the packet to a service provider in accordance with the applicable services for the packet, receiving, from the service provider, service results corresponding to the packet, and creating a forwarding entry providing instructions for handling the traffic flow in a service path table at the network device in accordance with the service results corresponding to the packet.

Abstract: A method of managing data transmission based on virtual local area networks includes obtaining a first VLAN property of a first physical interface and a second VLAN property of a second physical interface; in response to determining the first VLAN property and the second VLAN property are at least partially identical, obtaining a first virtual interface corresponding to the first physical interface and a second virtual interface corresponding to the second physical interface; and mapping the first physical interface and the second physical interface to an identical data channel via the first virtual interface and the second virtual interface, wherein the first physical interface and the second physical interface are located in a same processing device.

Abstract: A computer-implemented method for configuring and securing a first device, the method including performing a first check of the first device to determine the presence of unauthorized components or modules in a memory of the first device, performing a second check of the device to compare hardware components of the first device against a predetermined list of authorized components, initiating an encrypted virtual private network (VPN) tunnel between the first device and a second device that is remote from the first device by transmitting a request from the first device to the second device including data representing multiple parameters associated with the first device.

Abstract: One embodiment of the present invention provides a switch. The switch includes a port that couples to a server hosting a number of virtual machines. The switch also includes a set of virtual port grouping information and a virtual port grouping mechanism. During operation, the virtual port grouping mechanism determines whether a frame is traveling from a virtual port group to the same virtual port group. If the frame is not traveling to the same virtual port group, the virtual port grouping mechanism prevents the frame from being forwarded.

Abstract: A distributed network switch includes multiple switch modules connected by one or more physical cables. One switch module may determine which connector port of a remote switch module is connected by physical cable based on information received from the remote switch module, including link identifiers, and further based on a physical topology predetermined about the type of remote switch module.

Abstract: A communication apparatus communicating with an external apparatus via a relaying device is provided. The communication apparatus includes a communication unit configured to perform communication with the relaying device, and a control unit configured to reduce a communication speed of the communication unit to a lower speed if the communication apparatus is to be shifted from a first power mode to a second power mode in which power consumption is lower than that in the first power mode. The communication unit, if the communication apparatus shifts to the second power mode, transmits identification information of the communication apparatus to the relaying device using a first method, and after a predetermined time has passed, transmits the identification information to the relaying device by a second method.

Abstract: In some embodiments, an apparatus includes a core network node configured to associate with a native multicast group a first client device that is associated with a first virtual local area network (VLAN) and operatively coupled to the core network node via a first access network node and an aggregation network node. The core network node can associate with the native multicast group a second client device that is associated with a second VLAN and operatively coupled to the core network node via a second access network node and the aggregation network node. The core network node can define a multicast VLAN including the first VLAN and the second VLAN based on the native multicast group. The core network node can receive a multicast data unit associated with the native multicast group and can also define a single instance of the multicast data unit for the multicast VLAN.

Abstract: A network relay device capable of easily recognizing a state of hash value collision is provided. Each of a plurality of entries contained in an address table includes: a first area in which first information is registered, the first information indicating a relation between a plurality of ports and MAC addresses existing beyond the plurality of ports; and a second area in which second information is registered. In learning a transmission-source MAC address of a frame received at a port, a frame processing unit calculates a hash value by using the transmission-source MAC address first. Next, if a MAC address different from the transmission-source MAC address has been registered in the first area of an entry corresponding to the hash value, the frame processing unit registers the second information in the second area.

Abstract: Systems, apparatus and methods described herein are configured to dynamically assign network parameters based on a location (e.g., port) of a network parameter associated with a requesting device. In some embodiments, the systems, apparatus and methods described herein are further configured to facilitate network parameter assignment by an external network parameter assignment server based on the location (e.g., port) where a network parameter of requesting device is coupled.

Abstract: In one embodiment, a copy of an original packet of a traffic flow is created at an ingress leaf node of a cloud switch. The ingress leaf node forwards the original packet along a less-specific path through the cloud switch, the less-specific path based on a domain index of an egress domain for the original packet. The copy of the original packet is modified to create a more specific path learn request packet. The ingress leaf node forwards the more specific path learn request packet along the less-specific path through the cloud switch. The ingress leaf node received back a more specific path learn request reply packet that includes an indication of a fabric system port. The ingress leaf node then programs a forwarding table based on the indication of the fabric system port, to have subsequent packets of the traffic flow forwarded along a more-specific path.

Abstract: Techniques for allocation of a VLAN for a deployment by at least one VM provided on a host in a network. A VLAN manager is adapted to allocate a free physical VLAN identifier to the requested virtual VLAN identifier. The VLAN manager queries a VLAN mapping table for determining a free physical VLAN identifier. In case the physical VLAN identifier for the requested virtual VLAN identifier is in use, a procedure for determining the at least one free physical VLAN is performed. The determination procedure may be based on pre-defined zoning or it may apply a retagging after a free physical VLAN identifier has been calculated. The determined physical VLAN identifier is assigned to the requested VLAN. The VLAN switch devices are instructed about the assignment between the virtual and the physical VLAN identifier in order to apply the assignment of the data packets transported over the requested VLAN.