A controller, in a software-defined networking control layer, may determine auto-discovery parameters and may use the auto-discovery parameters to identify a first set of forwarding boxes within a network. The controller may identify a second set of forwarding boxes within the network that communicate with or are otherwise coupled to the first set of forwarding boxes. The controller may forward requests to the first and second sets of forwarding boxes to control traffic exchanged via the first and second sets of forwarding box. A third set of forwarding boxes located outside the network may request admissions into the software defined network, and requests from the third set of forwarding boxes may be forwarded to the controller via the first or second sets of forwarding boxes. The controller may authenticate the second and the third sets of forwarding boxes based on their relationship to the first set of forwarding boxes.