CN115694850A - VLAN switching-based terminal access control method - Google Patents

Abstract

The invention provides a terminal access control method based on VLAN switching, which comprises the following steps: connecting a server to a governing network requires two portal connections: a service management port; trunk port of the exchanger; II, secondly: adding connection information of the switch at the server; thirdly, the method comprises the following steps: the server is connected with the switch through the configured connection information and configures the switch; fourthly, the method comprises the following steps: after the switch finds that the mac address is online, the server immediately switches the port where the mac address is located to the isolation VLAN, and normal access is blocked; fifthly: the server receives the data packet; forwarding the arp request and the dns request to a normal VLAN; for the http network request, redirecting the access address to a server, and guiding to perform network authentication; sixthly: and after the terminal user in the isolation area downloads software from the server for installation and the system is repaired and passes the security check, the server switches the port of the switch to a legal VLAN, and the switch can normally access the network subsequently.

Description

A Terminal Admission Control Method Based on VLAN Switching

technical field

The invention relates to a terminal admission control method based on VLAN switching, and belongs to the technical field of network security.

Background technique

Today, with the informatization construction in full swing, more and more enterprises, institutions and government departments are applying information technology to modern office and business processing. After years of network construction, a complete network has gradually formed. For security access The requirements for flexibility and complexity of the system become higher accordingly. The network is becoming more and more complex, and there are more and more terminal access methods. There are various new and old network devices in the network, and there are various complex network structures, such as various terminals and switches of various brands. Therefore, how to achieve flexible control and secure access, and how to satisfy and adapt to the complexity of customer networks in an environment where multiple access methods coexist are difficult problems that must be solved in access research.

VLAN security gateway technology is a method to establish a variety of virtual gateway dynamic switching mechanisms on an IP-based network. The working principle of VLAN security gateway technology overcomes the problem that VLANs in the same subnet cannot communicate, so that although devices in the same subnet are in different VLANs, they can still communicate with each other without layer-3 routing. At the same time, in the process of switching VLANs with multi-virtual gateway technology, the system can guide to enter the authentication page, which solves the disadvantage that non-desktop management clients cannot perform WEB authentication. From the perspective of installation, it reduces the huge workload of network administrators.

The existing solution for network layer 2 access is also access based on 802.1x technology. This is a method provided by the switch to authenticate access devices to the network. The client sends an authentication packet of the EAP protocol, and the switch sends the authentication information to the network. Authenticate to the AAA server, and devices that pass the authentication can access the network. However, the 802.1x-based access method requires the switch to support 802.1x, so it is difficult to apply to low-end and old equipment, and all switches need to be manually configured, and the configuration methods of each manufacturer vary greatly, resulting in a huge workload for operation and maintenance. 802.1x access depends on the terminal equipment to install the client, which also limits its application range.

The VLAN-based admission method solves the above-mentioned problems of 802.1x, but there are still some implementation difficulties:

1. Due to the management based on the terminal mac address, it causes difficulties in management.

2. The switch needs to be configured, and certain operation and maintenance capabilities are required.

3. After the terminal is connected to the network, the system takes a long time to isolate it.

Contents of the invention

In order to solve the above problems, the present invention proposes a terminal admission control method based on VLAN switching, and the specific technical scheme is as follows,

A terminal admission control method based on VLAN switching, comprising the steps of:

Step 1: To connect the server to the management and control network, two network ports are required to connect: one business management port, which provides an ip address that can be accessed normally; one is connected to the trunk port of the switch;

Step 2: Add the connection information of the switch to the server;

Step 3: The server connects to the switch through the configured connection information, and configures the switch;

Step 4: After the switch discovers that the mac address is online, the server immediately switches the port where the mac address is located to the isolated VLAN to block its normal access to the network;

Step 5: When the end users in the isolated area access the network, because they are in the isolated VLAN and cannot communicate with the normal network, the data packets will be transmitted all the way to the trunk port connected to the server through the trunk port, and the server can receive the data packet; for the arp request , dns requests are forwarded to the normal VLAN; for http network requests, the access address is redirected to the server, and the terminal users in the isolated area are guided to perform network authentication;

Step 6: The terminal user in the isolated area downloads software from the server to install and perform system repair. After passing the security check, the server switches the switch port where the terminal user is located to a legal VLAN, and then the terminal user can access the network normally.

Preferably, the connection information in the step 2 specifically refers to telnet or ssh connection information.

Preferably, the information configured on the switch in the step 3 includes the switch manufacturer, login method, ip address, port number, user name, password, and advanced password. Through the configured information, the server can use the corresponding connection method to connect to the switch. Send a control command.

Preferably, in step 4, the switch discovers that the mac address is online through mac-trap and regular polling.

Further, after the switch discovers that the mac address is online in the step 4, the switch sends mac-trap information to the server, and the server searches for the switch configured to connect by sending the ip address of the trap, connects the switch through the information of the configuration, and then according to the information in the trap message The corresponding port and mac address information of the switch is used to perform VLAN switching on the corresponding port of the switch, and the port is switched to the isolated VLAN.

Preferably, the data packet obtained by the server through the trunk port in the step 5 is an 802.1Q data packet, and the 802.1Q data packet includes a 12-bit virtual local area network identifier VID, and the virtual local area network identifier VID marks the location where the data packet is located. VLAN, the mac address in the admission system associates the isolated VLAN with the normal VLAN. If the source mac address in the data packet is the isolated mac and the VID is the isolated VLAN, it means that the data packet is a request packet sent by the isolated VLAN; The destination mac address is the isolated mac and the VID is the normal VLAN, indicating that the data packet is a response data packet to the isolated VLAN; for the request packet that needs to be released, modify the VID field in the data packet to the id of the normal VLAN, and then modify the The data packet is sent through the trunk port; for the response packet that needs to be released, the VID field in the data packet is modified to the id of the isolated VLAN, and then the modified data packet is sent through the trunk port; through the forwarding of the server, the isolated VLAN is realized Limited data communication with normal VLANs.

The present invention has relatively low requirements on the switch, and the switch only needs to support VLAN configuration and switching functions. The amount of operation and maintenance is small, and the workload of operation and maintenance is greatly simplified through the background connection configuration. It is not mandatory to install the client, and the application scenarios are relatively wide.

Description of drawings

Fig. 1 is a working flowchart of a terminal admission control method based on VLAN switching in the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

VLAN: Virtual Local Area Network, that is, a virtual local area network. A virtual local area network (VLAN) is a group of logical devices and users. These devices and users are not limited by physical locations. They can be organized according to factors such as functions, departments, and applications. They communicate with each other as if they are in It is the same in the same network segment, hence the name virtual local area network.

802.1Q: Virtual Bridged Local Area Networks, IEEE 802.1q and VLANTagging belong to the standard specification of IEEE 802.1 under the Internet, allowing multiple bridges (Bridge) to share the same physical network publicly without information being leaked.

As shown in Figure 1, a terminal admission control method based on VLAN switching includes the following steps:

Step 1: To connect the server to the management and control network, two network ports are required to connect: a business management port, which provides an ip address that can be accessed normally; a trunk port connected to the switch, and the switch is connected to the switch through the trunk;

Step 2: Add the telnet or ssh connection information of the switch to the server;

Step 3: The server connects to the switch through the configured connection information, and configures the switch;

Step 4: After the switch discovers that the mac address is online through mac-trap and regular polling, the server immediately switches the port where the mac address is located to an isolated VLAN to block its normal access to the network;

Step 5: When the end users in the isolated area access the network, because they are in the isolated VLAN and cannot communicate with the normal network, the data packets will be transmitted all the way to the trunk port connected to the server through the trunk port, and the server can receive the data packet; for arp requests , dns requests are forwarded to the normal VLAN; for http network requests, the access address is redirected to the server, and the terminal users in the isolated area are guided to perform network authentication;

Step 6: The terminal user in the isolated area downloads software from the server to install and perform system repair. After passing the security check, the server switches the switch port where the terminal user is located to a legal VLAN, and then the terminal user can access the network normally. Through switch mac-trap and regular polling, after the mac address is found to be offline, the connection information of the terminal user is cleared to reduce the amount of system data maintenance.

The information configured on the switch in the step 3 includes the switch manufacturer, login method, ip address, port number, user name, password, and advanced password. Through the configured information, the server can use the corresponding connection method to connect to the switch to issue control commands . The switch control commands of different manufacturers are different, so it is necessary to deliver the corresponding version of the control command to the switch. For example, the command to switch port GigabitEthernet 0/0/1 to VLAN 10 on a Huawei switch is:

interface GigabitEthernet 0/0/1

port default VLAN 10

quit

When the device is connected to the switch and the switch finds that the mac address is online, the switch sends mac-trap information to the server, and the server searches for the configured switch by sending the ip address of the trap, connects to the switch through the configured information, and then uses the port in the trap message and mac address information to perform VLAN switching on the corresponding port of the switch, and switch the port to the isolated VLAN.

The device in the isolated VLAN cannot communicate with the normal network, so the data packets sent by the device will be propagated in the isolated VLAN. Through the trunk links of each node, these data packets can be transmitted all the way to the trunk port connected to the server, and the server can receive the data packets. The data packets obtained by the server through the trunk port are 802.1Q data packets. 802.1Q is not actually encapsulated in the original frame, instead, in the Ethernet frame format, a 32-bit field (field) is added to the original frame of the mac address source and the Ethernet type/length. The VLAN tag field must adhere to the following format:

16bits 3bits 1 bit 12bits TPID PCP CFI VID

Tag Protocol Identifier (TPID): A set of 16-bit fields whose value is set at 0x8100 to identify an IEEE 802.1q frame as "marked", and this field is marked The position is the same as the field of the ether form/length and the untagged frame, which is used to distinguish the untagged frame.

Priority Code Point (Priority Code Point, PCP): A set of 3-bit domains is used as a reference for IEEE 802.1q priority, from 0 (lowest) to 7 (highest), used for data streams (audio, video, files, etc.) as the transfer priority.

Canonical Format Indicator (Canonical Format Indicator, CFI): a 1-bit field. If the value of this field is 1, the mac address is in non-standard format; if it is 0, it is in standard format; it usually defaults to 0 in Ethernet switches. In Ethernet and Token Ring, CFI is used as a compatibility between the two. The value of CFI must be set to 1 if the frame is receiving data on the Ethernet port, and this port cannot be bridged with other untagged ports.

Virtual Local Area Network Identifier (VLAN Identifier, VID): a 12-bit field, used to specifically indicate which specific VLAN the frame belongs to. When the value is 0, it means that the frame does not belong to any VLAN; at this time, the 802.1Q tag represents the priority. The 12-bit values 0x000 and 0xFFF are reserved values, and other values can be used as identifiers for a total of 4094 VLANs. On the bridge, VLAN1 is administratively reserved. This 12-bit field can be divided into two 6-bit fields to extend the 48-bit address of the destination (Destination) and the source (Source), and the 18-bit triple-tagging (Triple-Tagging) can be added to the original 48 bits to become 66 bit address.

The server mainly pays attention to the VID field in the VLAN tag, which marks the VLAN in which the data packet is located. In the admission system, the isolation VLAN and the normal VLAN are associated through the mac address. If the source mac address in the data packet is the isolated mac and the VID is the isolated VLAN, it means that the data packet is a request packet sent by the isolated VLAN. If the destination mac address of the data packet is an isolated mac and the VID is a normal VLAN, it means that the data packet is a response data packet to the isolated VLAN. For the request packet that needs to be released, modify the VID field in the data packet to the id of the normal VLAN, and then send the modified data packet through the trunk port. For the response packet that needs to be released, modify the VID field in the data packet to the id of the isolated VLAN, and then send the modified data packet through the trunk port. Through the forwarding of the server, the limited data communication between the isolated VLAN and the normal VLAN is realized.

For example, there is an access switch in the intranet, and VLAN 10 is normally accessed. Connect the VLAN server to the core switch, and the service address of the server can communicate with VLAN10 normally. When the device is connected to the switch, the switch sends mac-trap information to the server, and the server recognizes that the A port of the switch has a mac address through analysis. The server connects to the switch through the configured connection information, and switches the A port to the configured isolation VLAN 999, so that the access device is isolated and cannot communicate with legitimate devices in the network.

After the device is connected, it initiates access to the network, and the server obtains the access data packet through the trunk port, and forwards basic requests such as arp and dns to the normal VLAN, and at the same time redirects the http request to the page address of the server to guide the user to authenticate. After the user passes the normal authentication under the guidance of the server, the server switches the port of the switch where the device is located back to the normal VLAN, and the device can access the network normally.

The present invention matches the IP and MAC addresses through the terminal information and the arp cache information of the switch, so that it can be managed in the form of a more readable IP address; in terms of operation and maintenance, the telnet or ssh connection of the switch is configured in the system , the switch can be automatically configured through the server, which greatly simplifies the difficulty of operation and maintenance. You can enable the mac-trap function on the switch to send the mac address online and offline information to the server, thereby speeding up the response speed of the system.

Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments, or perform equivalent replacements for some of the technical features. Within the spirit and principles of the present invention, any modifications, equivalent replacements, improvements, etc., shall be included in the protection scope of the present invention.

Claims (6)

1. A terminal access control method based on VLAN switching is characterized in that: the method comprises the following steps:

the method comprises the following steps: connecting a server to a management and control network requires two portal connections: a service management port for providing ip address which can be accessed normally; a trunk port connected to the switch;

step two: adding connection information of the switch at the server;

step three: the server is connected with the switch through the configured connection information and configures the switch;

step four: after the switch finds that the mac address is online, the server immediately switches the port where the mac address is located to the isolation VLAN, and normal access of the port to the network is blocked;

step five: when the terminal user in the isolation area accesses the network, because the terminal user is in the isolation VLAN and is not communicated with the normal network, the data packet can be transmitted to a trunk port connected with the server through the trunk port, and the server can receive the data packet; forwarding the arp request and the dns request to a normal VLAN; for the http network request, redirecting the access address to a server, and guiding the terminal user in the isolation area to perform network authentication;

step six: after the terminal user in the isolation area downloads software from the server for installation and the system is repaired and passes the security check, the server switches the port of the switch where the terminal user is located to a legal VLAN, and the subsequent terminal user can normally access the network.

2. A VLAN switching based terminal admission control method according to claim 1, wherein: the connection information in the second step specifically refers to telnet or ssh connection information.

3. The VLAN switching-based terminal admission control method according to claim 1, wherein: the information configuring the switch in the third step includes a manufacturer of the switch, a login mode, an ip address, a port number, a user name, a password and a high-level password, and the server can be connected with the switch by adopting a corresponding connection mode to issue a control command through the configured information.

4. The VLAN switching-based terminal admission control method according to claim 1, wherein: and the switch in the fourth step discovers the mac address online through a mac-trap and a timed polling mode.

5. A VLAN switch based terminal admission control method according to claim 4, characterised in that: and after finding that the mac address is online, the switch in the fourth step sends mac-trap information to the server, the server searches for the switch configured and connected through sending the ip address of the trap, connects the switch through the configured information, and then performs VLAN switching on the corresponding port of the switch according to the port and the mac address information in the trap message, and switches the port to the isolation VLAN.

6. The VLAN switching-based terminal admission control method according to claim 1, wherein: in the fifth step, the data packet obtained by the server through the trunk port is an 802.1Q data packet, the 802.1Q data packet includes a 12-bit virtual local area network identifier VID, the virtual local area network identifier VID marks the VLAN where the data packet is located, the isolated VLAN and the normal VLAN are associated in the admission system through the mac address, and if the source mac address in the data packet is the isolated mac and the VID is the isolated VLAN, it indicates that the data packet is a request data packet sent by the isolated VLAN; if the destination mac address of the data packet is the isolation mac and the VID is the normal VLAN, the data packet is a response data packet to the isolation VLAN; for a request packet needing to be released, modifying a VID field in a data packet into an id of a normal VLAN, and then sending out the modified data packet through a trunk port; for response packets needing to be released, modifying VID fields in the data packets into id of an isolation VLAN, and then sending out the modified data packets through trunk ports; limited data communication between the isolated VLAN and the normal VLAN is realized through the forwarding of the server.

Images