JP2002064525A - Switching hub and network management apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a switching hub that automatically sets a virtual LAN and realizes preferably network management at that point and to provide a network management apparatus. SOLUTION: The switching hub 101 detects that a terminal 105 is connected to a port #1, acquires an IP address of the terminal 105 or a host name from contents of data sent from the terminal 105 as terminal information and informs the network management apparatus 103 about the acquired terminal information. When the network management apparatus 103 receives the terminal information consisting of the IP address or the host name of the terminal 105 from the switching hub 101, the network management apparatus 103 returns a VLAN ID in response to the terminal information to the switching hub 101 as its reply. The switching hub 101 makes virtual LAN setting designated by the VLAN ID to the port #1.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a switching hub and a network management device capable of handling a virtual LAN, and more particularly to a switching hub capable of automatically setting a virtual LAN and a preferable network at that time. The present invention relates to a switching hub for realizing management and a network management device.

[0002]

2. Description of the Related Art Many switching hubs use virtual LANs.
It has the function of Similarly, the network management device has a function of managing a virtual LAN. Virtual LA
N is a technique for grouping arbitrary terminals connected to the network (physical LAN) independently of the physical LAN configuration. If the virtual LAN function is used, a logical subnet can be configured without being bound by physical wiring. Terminal groups belonging to the same virtual LAN group can communicate as if they belong to one LAN segment.

[0005] A virtual LAN is set by a procedure of setting a VLAN ID (a virtual LAN group identification number) for each virtual LAN group and setting the virtual LAN group to a port.

[0004]

When a terminal connected to a switching hub installed on a network is moved in place and this terminal is again joined to the same network as before the movement, the terminal is moved to the destination. It will be connected to a switching hub. At this time, it is necessary to change the address of the terminal, the setting of the virtual LAN in the switching hub, and the like. However, there are few cases where a general user who uses a terminal knows the switching hub to which the terminal is to be connected, the address of the switching hub, the configuration of the virtual LAN, and the like. In addition to this,
It is not easy for the user to change the settings because the user does not know how to change the settings for the switching hub. Therefore, every time the terminal is moved from place to place, it is necessary to call the network administrator and have the user make the setting, which is troublesome.

Therefore, an object of the present invention is to provide a switching hub and a network management device which solve the above-mentioned problems, enable automatic setting of a virtual LAN by a switching hub, and realize a preferable network management at that time. It is in.

[0006]

In order to achieve the above object, a switching hub of the present invention detects that a terminal is connected to a port in a switching hub having a virtual LAN function, and detects that the terminal is connected. It has a function of acquiring the IP address or host name of the terminal as terminal information from the content of the data to be transmitted, and notifying the acquired terminal information to the network management device.

When receiving a VLANID for assigning a virtual LAN group returned from the network management device as a response to the notification of the terminal information, the virtual LAN setting specified by the VLANID is assigned to the port to which the terminal is connected. It may have a function to perform.

[0008] A function may be provided for not setting a virtual LAN to a port to which the terminal is connected when receiving information indicating access prohibition returned from the network management device as a response to the notification of the terminal information.

For each port, a port for notifying the terminal information of the terminal to the network management device when the terminal is connected, and a port for not transmitting the terminal information of the terminal to the network management device even if the terminal is connected. May be provided.

[0010] Even if a terminal is connected, a function may be provided for performing a virtual LAN setting by a preset method for a port that does not notify the network management device of the terminal information of the terminal.

[0011] A function may be provided for designating in advance to which network management device the terminal information of the terminal connected to the port is to be transmitted.

A function may be provided for performing a virtual LAN setting by a preset method when there is no response from the network management device to the terminal information notification.

[0013] Further, the network management device of the present invention comprises:
When the switching hub is notified of the terminal information including the IP address or the host name of the terminal, a VLAN ID corresponding to the terminal information is returned to the switching hub as a response.

[0014] A function may be provided for managing the correspondence between the terminal information and the VLAN ID to be responded to when the terminal information is notified.

In order to manage the correspondence between an IP address and a VLANID, a plurality of IP addresses are specified using an IP subnet that pairs the IP address and a valid bit mask value, and the correspondence between the IP address and the VLANID is defined. May be provided.

A function may be provided for returning information indicating access prohibition corresponding to the terminal information as a response when the terminal information of the terminal is notified from the switching hub.

[0017] A function may be provided for managing the correspondence between the information indicating access prohibition and the terminal information.

In order to manage the correspondence between the information indicating the access prohibition and the IP address, a function may be provided for defining the IP address as an IP subnet.

A function may be provided for recording the contents of the notification and the response from the switching hub as a log and referring to the log on a management screen.

[0020]

An embodiment of the present invention will be described below in detail with reference to the accompanying drawings.

The network shown in FIG. 1 is provided with at least one switching hub and a network management device according to the present invention. As a physical connection configuration, it is assumed that the switching hub 101 has a network connected to port # 5 and a terminal 105 connected to port # 1. In addition, the switching hub 10
No. 2 assumes that a network is connected to port # 2. It is assumed that a network management device 103 is connected to this network.

As shown in FIG. 2, the internal configuration of the switching hub 201 used as the switching hubs 101 and 102 includes ports 202 to 206 forming ports # 1 to # 5, and data relay between the ports. , A processor 208 for providing various functions for virtual LAN setting, a memory 209 for storing various information, and the like.

The processing performed by the switching hubs 101 and 102 will be described below.

(1) When a terminal is connected to a port, an administrator sets in advance whether to transmit (notify) the IP address of the terminal to the network management apparatus for each port. The port set to transmit is called an automatically set virtual LAN port.

(2) For ports that are not automatically set virtual LAN ports, a fixed virtual LAN is set or G
The administrator sets in advance a virtual LAN setting such that the switching hub or a terminal connected to the switching hub can communicate with the upper network by a method such as setting the control port of the VRP.

(3) The address of the network management apparatus to which the IP address of the terminal is transmitted is set in advance by the administrator.

(4) Detecting that the terminal is connected to the port, obtaining the IP address of the terminal from the content of the data transmitted by the terminal,
The P address is notified to the network management device. Specifically, for example, when a new MAC address is registered in the filtering table, the IP address of the terminal is detected and transmitted to the network management device.

(5) When receiving a VLAN ID for assigning a virtual LAN group returned from the network management device as a response to the notification of the IP address, the VLAN ID is received by the port to which the terminal indicated by the IP address is connected. Virtual LA specified by VLANID
Set N groups.

(6) When the information indicating access prohibition returned from the network management device as a response to the notification of the IP address is received, what virtual LAN group is assigned to the port to which the terminal indicated by the IP address is connected. Also do not set.

(7) If there is no response from the network management device after transmitting the IP address to the network management device, the virtual LA specified in advance for this case is used.
Processing such as setting the N group to the port to which the terminal indicated by the IP address is connected or setting nothing is performed. What kind of processing is performed is set in advance by the administrator.

(8) The set configuration information of the switching hub is stored in the memory 209. This configuration information is used by the relay circuit 207 for communication processing.

The processing performed by the network management device 103 will be described below.

(1) A management table of each IP address, VLAN ID, and access setting is internally provided, and the setting of this management table can be performed on a management screen.

(2) When an IP address is transmitted from a switching hub, an IP address is searched from a management table that matches the received IP address, and if access to the IP address is set to permitted, the IP address is searched. Is returned to the switching hub, and if access of the IP address is set to prohibition, information indicating prohibition is returned to the switching hub.

(3) I that matches the received IP address
If the P address is not registered in the management table, the IP address is a pair of the IP address and the effective bit mask value.
IP registered in the management table using the subnet
Among the subnets, an IP subnet having a longer subnet mask length is searched. If access to the searched IP subnet is permitted, a VLAN ID corresponding to the IP subnet is returned to the switching hub, and the IP subnet is returned. If the access is prohibited, the information indicating the prohibition is returned to the switching hub.

(4) The inquiry (notification of the IP address) from the switching hub and the contents of the response thereto are recorded as a log. This log can be referred from the management screen.

Next, the operation of the network shown in FIG. 1 will be described.

Ports # 1 to # of switching hub 101
4 and ports # 1 and # 3 to # of the switching hub 102
5 is set to an automatically set virtual LAN port. A virtual LAN is set in the port # 5 of the switching hub 101 and the port # 2 of the switching hub 102 so that the own switching hub and terminals connected to the own switching hub can communicate with the upper network. For example, V
LANID is set as a tagging (Tagging) port of 1 or 2, or as a control port of GVRP.

In the switching hubs 101 and 102, the address of the network management device 103 is set as the address of the network management device to which the IP address of the terminal is transmitted.

The network management device 103 has a management table 104. In the management table 104, as shown in the figure, a VLAN ID and an access setting are set in advance corresponding to the IP address.

First, if the IP address is 172.17.3
3.1 terminal 105 is connected to switching hub 1 as shown in FIG.
It is assumed that the port is connected to port # 1 of port number 01. Terminal 105
Is transmitted from the switching hub 101
The MAC address of the terminal 105 is registered in a filtering table (not shown). At that timing, the IP address 172.17.33.1 of the terminal 105 is detected, and the IP address 172.17.33.1 is transmitted to the network management apparatus 103.

The network management device 103 searches the management table 104 for data corresponding to the received IP address 172.17.33.1 as data to be returned to the switching hub 101. In this example, IP
Since access to the address 172.17.33.1 is permitted, VLANID = 1 is set to the switching hub 10.
Reply to 1.

When the switching hub 101 receives VLANID = 1, the switching hub 101 sets a virtual L
Set the AN group. Thereby, the terminal 105
The VLAN ID belongs to one virtual LAN group.

Next, the terminal 105 is connected to the switching hub 10.
It is assumed that port 2 has been moved to port # 3. When the frame is transmitted from the terminal 105, the network management apparatus 103 responds to the notification from the switching hub 102, and sends the VLANI to the port # 3 of the switching hub 102.
Since the virtual LAN group in which D is 1 is set, the terminal 1
05 belongs to the virtual LAN group whose VLAN ID is 1. When the terminal 105 is moved to any of the automatically set virtual LAN ports, the VLAN ID is assigned to that port.
Is set as a virtual LAN group.

The IP address of the terminal 105 is 172.1
In the case of 7.33.2, access is prohibited in the management table 104, so the network management apparatus 10
3 returns information indicating access prohibition to the switching hub. The switching hub that has received the information indicating the access prohibition does not set any virtual LAN group to the port to which the terminal 105 is connected. As a result, the terminal 105 cannot be logically connected to the network.

The IP address of the terminal 105 is 172.1
In the case of 7.33.3, since no matching IP address is registered in the management table 104, the management table 1
Among the IP subnets registered in the IP subnet 04, the data of the IP subnet having the longest matching subnet mask length is used. Therefore, the IP address 172.17.3
For 3.3, see 172.17.33. * / 24 I
The P subnet meets the above conditions. So, VLA
NID = 1 is returned.

The IP address of the terminal 105 is 172.1
In the case of 7.1.1, the matching I
P address is not registered. In this case, the IP subnet 172. *. *. * / 8 meets the above conditions. Then, VLANID = 20 is returned.

The IP address of the terminal 105 is 1.1.1.
1, IP subnet *. *. *. * / 0 matches, and information indicating access prohibition is returned.

The contents of the inquiries from the switching hubs 101 and 102 and the responses to the inquiries are recorded in the network management device 103 as logs. The administrator can refer to this log from the management screen.

When there is no response to the notification of the terminal IP address, for example, when the switching hubs 101 and 102 cannot communicate with the network management apparatus 103, the switching hubs 101 and 102 are designated in advance for this case. For example, the virtual LAN group that has been set is set as a port, and the terminal is not set so as not to participate in the network. What kind of processing is performed can be set in advance.

The configuration information of the switching hubs 101 and 102 set as described above is stored in the memory 209 of each of the switching hubs 101 and 102. This configuration information is used by the relay circuit 207 for communication processing.

Next, a network management system for identifying a terminal using a host name instead of an IP address will be described.

The network shown in FIG. 3 has the same physical connection configuration as that of FIG. 1, and the setting of the automatically set virtual LAN port is the same. However, as shown in FIG. 3, the VLAN ID and the access setting are set in the management table 104 in correspondence with the host name.

It is assumed that the terminal 105 having the host name red is connected to the port # 1 of the switching hub 101. When the frame is transmitted from the terminal 105, the switching hub 101 stores the terminal 1 in the filtering table.
At the timing when the MAC address 05 is registered, the IP address of the terminal 105 is detected, the host name red is searched by the DNS, and the host name red is notified to the network management apparatus 103.

The network management device 103 searches the management table 104 for the received host name red. Since the access of the host name “red” is permitted, the VLAN
ID = 1 is returned to the switching hub 101. The switching hub 101 sets a virtual LAN group with a VLAN ID of 1 on port # 1. Thereby, the terminal 10
5 belongs to the virtual LAN group whose VLAN ID is 1.

When the terminal 105 is moved to the port # 3 of the switching hub 102, the virtual LA having the VLAN ID of 1 is similarly assigned to the port # 3 of the switching hub 102.
N groups are set. Terminal 105 is automatically set virtual L
No matter which of the AN ports is moved to, the VL
A virtual LAN group with an ANID of 1 is set.

When the host name of the terminal 105 is blue,
Since access is set to be prohibited in the management table 104, information indicating that the access is prohibited is returned from the network management apparatus 103 to the switching hub. In the switching hub, no virtual LAN group is assigned to the port to which the terminal 105 is connected. Is not set, the terminal 105 cannot be logically connected to the network.

When the host name of the terminal 105 is gray,
Since “Other” in the management table 104 is referred to and access is set to be prohibited, the network management device 1
From 03, the information indicating access prohibition is returned to the switching hub, and the switching hub does not set any virtual LAN group to the port to which the terminal 105 is connected, so that the terminal 105 can be logically connected to the network. Can not. Thus, it is possible to prevent a terminal having an unknown host name from accessing the network.

The inquiries from the switching hubs 101 and 102 and the contents of the responses to the inquiries are recorded in the network management device 103 as logs. The administrator can refer to this log from the management screen.

If there is no response to the notification of the host name of the terminal, such as when the switching hubs 101 and 102 cannot communicate with the network management device 103, the switching hubs 101 and 102 are designated in advance for this case. For example, the virtual LAN group that has been set is set as a port, and the terminal is not set so as not to participate in the network. What kind of processing is performed can be set in advance.

[0061]

The present invention exhibits the following excellent effects.

(1) When the network management system realized by the switching hub and the network management device of the present invention is used, when the terminal is moved, if the terminal is connected to the switching hub, the switching hub automatically becomes an appropriate virtual LAN. Since the setting is performed, the user does not need to change the setting.

(2) The virtual LAN can be integratedly managed by the terminal information including the IP address or the host name of the terminal.

(3) Only the terminal having the terminal information including the permitted IP address or host name can participate in the network, so that the security of the network is ensured.

(4) It is possible to refer to a log indicating which terminal is set to which virtual LAN group and when.

(5) The address of the network management device can be set freely.

(6) The virtual LAN setting method according to the present invention may not be used.

(7) Whether the virtual LAN setting method according to the present invention is used or not can be set for each port.

(8) The processing when there is no response to the notification of the terminal information including the IP address or the host name of the terminal can be set in advance.

[Brief description of the drawings]

FIG. 1 is a network configuration diagram showing an embodiment of the present invention.

FIG. 2 is an internal configuration diagram of a switching hub showing one embodiment of the present invention.

FIG. 3 is a network configuration diagram showing another embodiment of the present invention.

[Explanation of symbols]

 101, 102 Switching Hub 103 Network Management Device 104 Management Table 105 Terminal

Claims (14)

[Claims] In a switching hub having a virtual LAN function, it is detected that a terminal is connected to a port, and an IP address or a host name of the terminal is used as terminal information based on data transmitted by the terminal. A switching hub having a function of acquiring and notifying the network management device of the acquired terminal information. 2. When receiving a VLANID for allocating a virtual LAN group returned from a network management device as a response to the notification of the terminal information, the virtual LAN specified by the VLANID is assigned to a port to which the terminal is connected. 2. The switching hub according to claim 1, further comprising a setting function. 3. A function of not setting a virtual LAN to a port to which the terminal is connected when receiving information indicating access prohibition returned from a network management device as a response to the notification of the terminal information. The switching hub according to claim 1 or 2, wherein 4. For each port, when a terminal is connected, a terminal for notifying terminal information of the terminal to the network management device, and even when the terminal is connected, terminal information of the terminal is not notified to the network management device. The switching hub according to any one of claims 1 to 3, further comprising a function of setting a port. 5. The apparatus according to claim 4, further comprising a function of setting a virtual LAN by a preset method for a port that does not notify the network management device of terminal information even if the terminal is connected. Switching hub. 6. The switching hub according to claim 1, further comprising a function of designating in advance to which network management apparatus terminal information of a terminal connected to the port is to be transmitted. 7. The apparatus according to claim 1, further comprising a function of performing a virtual LAN setting by a preset method when there is no response from the network management apparatus to the notification of the terminal information. Switching hub. 8. When a terminal information including a terminal IP address or a host name is notified from a switching hub,
A network management device, which returns a VLAN ID corresponding to the terminal information to the switching hub as a response. 9. The network management apparatus according to claim 8, further comprising a function of managing a correspondence between the terminal information and a VLAN ID to be responded to when the terminal information is notified. 10. In order to manage the correspondence between an IP address and a VLANID, a plurality of IP addresses are specified using an IP subnet that pairs the IP address and a valid bit mask value, and the correspondence between the IP address and the VLANID is defined. 10. The network management device according to claim 9, further comprising a function of defining 11. The apparatus according to claim 8, further comprising a function of returning information indicating access prohibition corresponding to the terminal information as a response when the terminal information of the terminal is notified from the switching hub. Network management equipment. 12. The network management apparatus according to claim 11, further comprising a function of managing a correspondence between the information indicating the access prohibition and the terminal information. 13. An IP address for managing the correspondence between the information indicating access prohibition and the IP address.
13. The network management device according to claim 12, further comprising a function of defining a subnet. 14. The system according to claim 8, further comprising a function of recording a notification from the switching hub and the contents of the response as a log, and referencing the log on a management screen.
The network management device according to any one of the above.