Device plug-in system for configuring network device over a public network

• US 20030037128A1
• Filed: 08/13/2002
• Published: 02/20/2003
• Est. Priority Date: 08/14/2001
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: SmartPipes, Incorporated (Sophos Group Ltd.)
• Inventors: Beadles, Mark A., Bell, Raymond J., Russo, Kevin A., Emerick, William S., Mulh, Kenneth E.
• Granted Patent: US 7,284,042 B2
• Time in Patent Office: Days
• US Class Current: 709/220
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The present invention provides device configuration and policy configuration data to network devices over a public network, e.g., the internet. A secure communication link is first established over the public network to the network device. Next, policy and configuration information is downloaded to the network device using that secure communication link. In one embodiment, the communication link is an IPSec tunnel. In particular, the network policy may include a virtual private network (VPN) policy. The invention addresses the secure downloading of configuration and policy information, which has not been an issue in prior art devices where there was an ability to provide such information internally to a network, without the need to go over the internet.

Claims

1. A method for configuring a network device over a public network, comprising:

establishing a communication link to said network device;

downloading to said network device over said public network a bootstrap partial configuration to enable establishment of a secure channel;

establishing a secure channel over said public network with said network device using said bootstrap partial configuration; and

downloading full configuration data over said secure channel to said network device.

2. The method of claim 1 wherein said network device is a router, and said establishing a communication link comprises clear-text telenetting.

3. The method of claim 1 further comprising:

changing credentials and a key of said network device after downloading said bootstrap partial configuration.

4. The method of claim 3 wherein said full configuration data is a virtual private network (VPN) policy, which is downloaded after said credentials and key are changed.

5. The method of claim 1 wherein said downloading uses a trivial file transfer protocol (TFTP).

6. A device plug-in layer of a network management system for transmitting network policy over a public network to network devices, comprising:

a push model interface configured to push network policy configurations onto a network device responsive to an event in said network management system; and

a pull model interface configured to provide network policy configurations to a network device responsive to a request from said network device.

7. The device plug-in layer of claim 6 wherein said pull model interface is implemented as a COM object that is called from an ASP page.

8. The device plug-in layer of claim 6 wherein said push model interface is implemented as an operating system service.

9. The device plug-in layer of claim 6 wherein both said push and pull model interfaces are configured to provide both configuration data and policy data to a network device.

10. A device plug-in layer of a network management system for transmitting network policy over a public network to network devices, comprising:

a push model interface configured to push network policy configurations onto a network device responsive to an event in said network management system, said push model interface being implemented as an operating system service; and

a pull model interface configured to provide network policy configurations to a network device responsive to a request from said network device, said pull model interface being implemented as a COM object that is called from an ASP page;

wherein both said push and pull model interfaces are configured to provide both configuration data and policy data to a network device.

11. A device simulator for a network management system, comprising:

a simulator interface for simulating a command interface to devices controlled by said network management system;

an event storage; and

an event reporting system for receiving events from said network management system, storing events in said event storage, and providing event responses to said command interface after a simulated response time.

12. The device simulator of claim 11 wherein said event reporting system is a publisher and subscriber model of COM+.

13. The device simulator of claim 11 wherein said event responses include error messages and data flow messages.