Topology explorer

• US 10,498,608 B2
• Filed: 10/23/2017
• Issued: 12/03/2019
• Est. Priority Date: 06/16/2017
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sethi, Divjyot, Nagarajan, Chandra, Kompella, Ramana Rao, Gupta, Gaurav, Iyer, Sundar
• Primary Examiner(s): Thompson, Jr., Otis L
• Application Number:
  US15/790,577
• Publication Number:
  US 20180367412A1
• Time in Patent Office: 771 Days
• Field of Search: None
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV

Abstract

Systems, methods, and computer-readable media for discovering a network'"'"'s topology and health. In some examples, a system can obtain, from at least one of a plurality of controllers on a network, a logical model of the network, the logical model including configurations of one or more objects defined for the network. Based on the logical model, the system can identify a respective location of the plurality of controllers in the network and a plurality of nodes in a fabric of the network. Based on the respective location of the plurality of controllers and plurality of nodes, the system can poll the plurality of controllers and plurality of nodes for respective status information, and determine a health and topology of the network based on the logical model, the respective location, and respective status information.

Claims

1. A method comprising:

obtaining, from at least one controller on a network, a logical model of the network, the logical model comprising configurations of one or more objects defined for the network;

based on the logical model, identifying a respective location of the at least one controller and a plurality of nodes in a fabric of the network;

based on the respective location, polling the at least one controller and the plurality of nodes for respective status information;

determining a health and topology of the network based on the logical model and the respective status information of the at least one controller and the plurality of nodes;

identifying one of the plurality of nodes having an unreachable status; and

based on the unreachable status of the one of the plurality of nodes, determining the one of the plurality of nodes has not obtained one or more policies deployed on the network and the one or more policies will not be applied to traffic between the fabric and one or more devices connected to the fabric via the one of the plurality of nodes.

2. The method of claim 1,

wherein,

the respective status information includes at least one of a respective reachability status, a respective state, a respective responsiveness, or a respective configuration,

the determining of the health and topology of the network is based on the respective location and the configurations of the one or more objects in the logical model,

the configurations of the one or more objects include at least one of contracts, networking configurations, rules, or policies, and

the one or more objects include at least one of tenants, endpoint groups, application profiles, network contexts, bridge domains, or network elements.

3. The method of claim 2, wherein the respective state includes at least one of an active state, an inactive state, a disabled state, a discovered state, and an unknown state, and wherein the respective configuration comprises at least one of a compatibility status, a software version, a hardware version, or a security parameter.

4. The method of claim 2, wherein the determining of the health and topology of the network includes identifying a network partition based on a respective status of the at least one controller and the plurality of nodes.

5. The method of claim 1,

wherein,

the at least one controller includes a plurality of controllers, and

the method includes:

based on the respective status information, determining a respective status of the plurality of controllers, the respective status includes at least one of a respective reachability status, a respective state, a respective registration, or a respective configuration;

based on the respective status, determining a number of controllers in the plurality of controllers having a predetermined status; and

based on the number of controllers having the predetermined status, determining whether the plurality of controllers are in a quorum.

6. The method of claim 5,

wherein,

the predetermined status includes at least one of a predetermined reachability status, a predetermined state, a predetermined registration, or a predetermined configuration, and

the determining of whether the plurality of controllers are in the quorum is based on a quorum rule specifying a threshold number of the plurality of controllers needed to form the quorum.

7. The method of claim 6,

wherein,

the one or more devices are identified based on the topology of the network,

the one or more devices include at least one of a physical device or a logical device,

the logical device includes at least one of a virtual machine, a virtual service, or a software container;

the one or more policies include a security policy associated with the one or more devices; and

the determining the one of the plurality of nodes has not obtained the one or more policies and that the one or more policies will not be applied to the traffic includes determining the security policy has not been deployed at the one of the plurality of nodes and will not be applied to the traffic between the fabric and the one or more devices connected to the fabric via the one of the plurality of nodes.

8. The method of claim 7,

wherein,

the determining the security policy will not be applied to the traffic is performed prior to traffic flowing between the fabric and the one or more devices,

the method includes generating a security alert indicating the security policy will not be applied to the traffic.

9. The method of claim 1,

wherein,

the at least one controller includes a cluster of controllers, and

the method includes:

based on the respective status information, determining a respective reachability status of each controller in the cluster of controllers;

based on the respective reachability status of each controller in the cluster of controllers, determining that the cluster of controllers has a partially fit status, the partially fit status indicating that at least one controller in the cluster of controllers is unreachable by one or more network segments in the network; and

generating a notification of the partially fit status of the cluster of controllers.

10. A system comprising:

one or more processors; and

at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the system to;

obtain, from at least one of a plurality of controllers on a network, a logical model of the network, the logical model including configurations of one or more objects defined for the network;

based on the logical model, identify a respective location of the plurality of controllers in the network and a plurality of nodes in a fabric of the network;

based on the respective location, request respective status information from the plurality of controllers and the plurality of nodes;

determine a health and topology of the network based on the logical model and the respective status information of the plurality of controllers in the network and the plurality of nodes in the fabric;

identify one of the plurality of nodes having an unreachable status; and

based on the unreachable status of the one of the plurality of nodes, determine the one of the plurality of nodes has not obtained a policy deployed on the network and the policy will not be applied to traffic between the fabric and one or more network elements connected to the fabric via the one of the plurality of nodes.

11. The system of claim 10,

wherein,

the respective status information includes at least one of a respective reachability status, a respective state, a respective registration, or a respective configuration,

determining the health and topology is based on the respective location and the configurations of the one or more objects in the logical model,

the configurations and the one or more objects include at least one of contracts, networking configurations, policies, tenants, rules, endpoint groups, application profiles, network contexts, or network elements, and

the respective location includes at least one of a respective name in the network or a respective network address.

12. The system of claim 11, wherein determining the health and topology of the network includes identifying a network partition based on a respective status of at least one of the plurality of controllers or the plurality of nodes.

13. The system of claim 10, wherein the instructions, when executed by the one or more processors, further cause the system to:

based on the respective status information, determine a respective status of the plurality of controllers, the respective status include at least one of a respective reachability status, a respective state, a respective registration, or a respective configuration;

based on the respective status, determine a number of controllers in the plurality of controllers having a predetermined status; and

based on the number of controllers having the predetermined status, determine whether the plurality of controllers are in a quorum.

14. The system of claim 13, wherein the predetermined status comprises at least one of a predetermined reachability status, a predetermined state, a predetermined registration, and a predetermined configuration, and wherein determining whether the plurality of controllers are in the quorum is based on a quorum rule that specifies a threshold number of controllers needed to form the quorum.

15. The system of claim 10,

wherein,

the one or more network elements are identified based on the topology of the network,

the policy is associated with the one or more network elements.

16. A non-transitory computer-readable storage medium comprising:

instructions stored therein instructions which, when executed by one or more processors, cause the one or more processors to;

obtain, from at least one of a plurality of controllers on a network, a logical model of the network, the logical model comprising configurations of one or more objects defined for the network;

based on the logical model, identify a respective location of the plurality of controllers in the network and a plurality of nodes in a fabric of the network;

based on the respective location, request respective status information from the plurality of controllers and the plurality of nodes; and

determine a health and topology of the network based on the logical model, the respective location, and the respective status information;

identify one of the plurality of nodes having an unreachable status; and

based on the unreachable status of the one of the plurality of nodes, determine the one of the plurality of nodes has not obtained a policy deployed on the network and the policy will not be applied to traffic between the fabric and one or more network elements connected to the fabric via the one of the plurality of nodes.

17. The non-transitory computer-readable storage medium of claim 16,

wherein,

the one or more network elements are identified based on the topology of the network;

the policy is associated with the one or more network elements.

18. The non-transitory computer-readable storage medium of claim 16,

wherein,

the respective status information includes at least one of a respective reachability status, a respective compatibility, or a respective state,

the configurations and one or more objects include at least one of contracts, networking configurations, policies, tenants, rules, endpoint groups, application profiles, network contexts, or object properties, and

determining the health and topology of the network includes identifying a network partition based on the respective reachability status of at least a controller of the plurality of controllers and a node of the plurality of nodes.

19. The non-transitory computer-readable storage medium of claim 16,

wherein,

the plurality of controllers includes a cluster of controllers, and

the instructions further cause the one or more processors to:

based on the respective status information, determine a respective reachability status of each controller in the cluster of controllers;

based on the respective reachability status of each controller in the cluster of controllers, determine that the cluster of controllers has a partially fit status, the partially fit status indicating that at least one controller in the cluster of controllers is unreachable from one or more locations in the network; and

generate a notification of the partially fit status of the cluster of controllers.