VLAN Tunneling

Abstract

According to one embodiment of the invention, a method is described that is directed to sending, by a network device, information over a first tunnel associated with a first virtual local area network. Also, a second tunnel associated with the second virtual local area network is created by the network device if the information is determined to be received from a network device that is a member of the second virtual local area network differing from the first virtual local area network. Herein, the first tunnel and the second tunnel each encapsulates at least data link traffic.

1 . A method comprising:
 sending, by a network device, information over a first tunnel associated with a first virtual local area network; and   creating, by the network device, a second tunnel associated with the second virtual local area network if the information is determined to be received from a network device that is a member of the second virtual local area network differing from the first virtual local area network, wherein the first tunnel and the second tunnel each encapsulates at least data link traffic.   
     
     
         2 . The method of  claim 1 , further comprising:
 performing, by the network device, a multicast key exchange to establish a multicast key for the second tunnel, wherein the multicast key is different from the key used to encrypt traffic in the first tunnel; and   blocking, by the network device, messages from the network device until the multicast key exchange has completed.   
     
     
         3 . The method of  claim 2 , wherein the first tunnel facilitates encrypted communications with the network device using a key differing from the multicast key. 
     
     
         4 . The method of  claim 1 , further comprising:
 determining, by the network device, that the information is received from the network device assigned to the second virtual local area network.   
     
     
         5 . The method of  claim 4 , further comprising:
 determining, by the network device, a type of encryption used when transferring the information over the first tunnel; and   determining, by the network device, that the second tunnel is needed if the type of encryption used by the information differs from a type of encryption supported by the first tunnel.   
     
     
         6 . The method of  claim 5 , wherein the type of encryption supported by the first tunnel comprises a Wired Equivalent Privacy (WEP) encryption, and wherein the type of encryption supported by the second tunnel comprises a non-WEP encryption. 
     
     
         7 . The method of  claim 1 , wherein creating the second tunnel comprises creating a network layer tunnel that transfers both encapsulated data link layer traffic and encapsulated network layer traffic. 
     
     
         8 . A network device comprising:
 a memory;   a processor;   a transmitting mechanism operating with the processor, the transmitting mechanism to send information over a first tunnel associated with a first virtual local area network; and   a tunneling mechanism operating with the processor, the tunneling mechanism to create a second tunnel associated with the second virtual local area network if the information is determined to be received from a network device that is a member of the second virtual local area network differing from the first virtual local area network, wherein the first tunnel and the second tunnel each encapsulates at least data link traffic.   
     
     
         9 . The network device of  claim 8 , wherein the tunneling mechanism further to:
 perform a multicast key exchange to establish a multicast key for the second tunnel, wherein the multicast key is different from the key used to encrypt traffic in the first tunnel; and   block messages from the network device until the multicast key exchange has completed.   
     
     
         10 . The network device of  claim 9 , wherein the first tunnel facilitates encrypted communications with the network device using a key differing from the multicast key. 
     
     
         11 . The network device of  claim 8 , further comprising:
 a determining mechanism operating with the processor, the determining mechanism to determine that the information is received from the network device assigned to the second virtual local area network.   
     
     
         12 . The network device of  claim 11 , wherein the determining mechanism further to:
 determine a type of encryption used when transferring the information over the first tunnel; and   determine that the second tunnel is needed if the type of encryption used by the information differs from a type of encryption supported by the first tunnel.   
     
     
         13 . The network device of  claim 12 , wherein the type of encryption supported by the first tunnel comprises a Wired Equivalent Privacy (WEP) encryption, and wherein the type of encryption supported by the second tunnel comprises a non-WEP encryption. 
     
     
         14 . The network device of  claim 8 , wherein creating the second tunnel comprises creating a network layer tunnel that transfers both encapsulated data link layer traffic and encapsulated network layer traffic. 
     
     
         15 . A non-transitory computer-readable storage medium having instructions stored thereon, when executed by a processor embedded within a network device of a network, causes the network device to perform a plurality of operations comprising:
 sending information over a first tunnel associated with a first virtual local area network; and   creating a second tunnel associated with the second virtual local area network if the information is determined to be received from a network device that is a member of the second virtual local area network differing from the first virtual local area network, wherein the first tunnel and the second tunnel each encapsulates at least data link traffic.   
     
     
         16 . The non-transitory computer-readable storage medium of  claim 15 , further comprising:
 performing a multicast key exchange to establish a multicast key for the second tunnel, wherein the multicast key is different from the key used to encrypt traffic in the first tunnel; and   blocking messages from the network device until the multicast key exchange has completed.   
     
     
         17 . The non-transitory computer-readable storage medium of  claim 16 , wherein the first tunnel facilitates encrypted communications with the network device using a key differing from the multicast key. 
     
     
         18 . The non-transitory computer-readable storage medium of  claim 15 , further comprising:
 determining that the information is received from the network device assigned to the second virtual local area network.   
     
     
         19 . The non-transitory computer-readable storage medium of  claim 18 , further comprising:
 determining a type of encryption used when transferring the information over the first tunnel; and   determining that the second tunnel is needed if the type of encryption used by the information differs from a type of encryption supported by the first tunnel.   
     
     
         20 . The non-transitory computer-readable storage medium of  claim 19 , wherein the type of encryption supported by the first tunnel comprises a Wired Equivalent Privacy (WEP) encryption, and wherein the type of encryption supported by the second tunnel comprises a non-WEP encryption. 
     
     
         21 . The non-transitory computer-readable storage medium of  claim 15 , wherein creating the second tunnel comprises creating a network layer tunnel that transfers both encapsulated data link layer traffic and encapsulated network layer traffic.