SNMP firewall

• US 20040044758A1
• Filed: 09/04/2002
• Published: 03/04/2004
• Est. Priority Date: 09/04/2002
• Status: Active Grant

• Current Assignee: Northrop Grumman Systems Corporation (Northrop Grumman Corporation)
• Original Assignee: Northrop Grumman Systems Corporation (Northrop Grumman Corporation)
• Inventors: Palmer, John, Vazquez, George O.
• Granted Patent: US 7,606,884 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

Systems and methods are provided for exchanging Small Network Management Protocol (SNMP) messages in a multi-network system between devices across different networks and a network management station. Network identification information is provided into SNMP messages transmitted across a common network backbone. A respective SNMP firewall provided at the networks extract the network identification information to determine if the SNMP message is addressed to a device in the respective network. The SNMP firewall removes the network identification information and forwards the SNMP message to the destination device if the SNMP message is associated with a device in the respective network. Providing network identification information in the SNMP messages allows devices in different networks to have similar IP addresses, while still allowing current SNMP tool sets to facilitate network managements when networks are coupled to one another to form a larger more complex network.

Claims

1. A system for exchanging Small Network Management Protocol (SNMP) messages in a multi-network intranet, the system comprising:

a network management station that transmits SNMP messages containing a device address and network identification information corresponding to a destination device of an SNMP message; and

a plurality of networks coupled together to form an intranet, the plurality of networks having a respective SNMP firewall, the SNMP firewall extracts the network identification information to determine if an SNMP message is destined for a device residing in the respective network, the SNMP firewall removes the network identification information from the SNMP message and forwards the SNMP message to a device associated with the device address.

2. The system of claim 1, the device being one of a computer, a router, a bridge, a printer and a mobile communication unit.

3. The system of claim 1, the SNMP firewall employs a lookup table to determine an associated device address corresponding to the device address and the network identification information.

4. The system of claim 1, the network management station inserts a network identifier into the SNMP message to provide the network identification information.

5. The system of claim 1, the network management station provides a virtual address into the SNMP message to provide the network identification information.

6. The system of claim 1, the network management station further comprises a user interface that allows an administrator to transmit SNMP commands that include network identification information.

7. The system of claim 1, the SNMP firewall provides network identification information to at least one of SNMP response messages and SNMP event messages provided by an SNMP agent residing on a destination device prior to transmission of the at least one of SNMP response messages and SNMP event messages to the network management station.

8. The system of claim 7, the SNMP firewall comprising a filter component that extracts network identification information from SNMP messages transmitted from the network management stations and a map component that provides network identification information to the at least one of SNMP response messages and SNMP event messages to the network management station.

9. The system of claim 1, the device address being an Internet Protocol (IP) address.

10. The system of claim 9, at least two devices in different networks of the plurality of networks have duplicate IP addresses.

11. The system of claim 1, the internet being the Internet.

12. The system of claim 1, at least one of the plurality of networks being a wireless network.

13. The system of claim 1, further comprising a replication engine that updates a lookup table when a new member enters one of the plurality of networks, the lookup table contains network identification information and corresponding device addresses, the SNMP firewall utilizing the lookup table to locate a destination device.

14. A network management station for transmitting Small Network Management Protocol (SNMP) messages to devices in a plurality of networks with possibly conflicting Internet Protocol (IP) addresses, the station comprising:

a user interface that allows an administrator to enter SNMP commands that contain network identification information and a device IP address; and

an SNMP manager that transmits SNMP packets that contain the network identification information provided by the administrator.

15. The station of claim 14, further comprising a translator that employs a lookup table to provide the network identification information into the SNMP packets.

16. The station of claim 14, the network identification information being a network identifier inserted into the SNMP packets.

17. The station of claim 14, the network identification information being provided by replacing the device IP address with a virtual IP address.

18. A computer readable medium having computer executable components comprising:

a filter component that extracts network identification information from SNMP messages that contain network identification information and device address information to determine if an SNMP message is destined for a device residing in a network associated with the filter component, the filter component removes the network identification information from the SNMP message and forwards the SNMP message to a device associated with the device address information; and

a map component that provides network identification information to at least one of SNMP response messages and SNMP event messages received from an SNMP agent that resides on a device to be transmitted to a network management station.

19. The computer-readable medium of claim 18, the filter component and the map component employ a lookup table to determine an associated device address corresponding to the device address and the network identification information.

20. A Small Network Management Protocol (SNMP) packet comprising:

a header portion;

a network identification information portion; and

an SNMP message portion.

21. The SNMP packet of claim 20, the network identification information portion comprising a network identifier.

22. The SNMP packet of claim 20, the network identification information portion being provided a virtual Internet Protocol (IP) address.

23. A method for exchanging Small Network Management Protocol (SNMP) messages between a network management station and a destination device, the method comprising:

inputting an SNMP command with network identification information at a network management station;

providing an SNMP packet with network identification information in response to the SNMP command; and

transmitting the SNMP packet with the network identification information over a network backbone connecting a plurality of networks that form an intranet.

24. The method of claim 23, the providing an SNMP packet with network identification information in response to the SNMP command comprising inserting a network identifier into the SNMP packet.

25. The method of claim 23, the providing an SNMP packet with network identification information in response to the SNMP command comprising replacing an IP device address with a virtual IP address.

26. A method for determining a destination device for a Small Network Management Protocol (SNMP) packet in a multi-network system having the possibility of duplicate Internet Protocol (IP) addresses in different networks, the method comprising:

monitoring SNMP packets from at least one network in the multi-network system;

determining if an SNMP packet includes network identification information corresponding to the monitored network; and

removing the network identification information from the SNMP packet and forwarding the SNMP packet to a destination device corresponding to an IP address associated with the destination.

27. The method of claim 26, further comprising providing an SNMP response packet from the destination device with network identification information and transmitting the SNMP response packet to a network management station.

28. The method of claim 26, further comprising providing an SNMP event packet from the destination device with network identification information and transmitting the SNMP event packet to a network management station.

29. A system for exchanging Small Network Management Protocol (SNMP) messages in a multi-network intranet, the system comprising:

means for transmitting SNMP messages containing a device address and network identification information corresponding to a destination device of an SNMP message;

means for extracting the network identification information to determine if an SNMP message is destined for a device residing in the respective network;

means for removing the network identification information from the SNMP message; and

means for forwarding the SNMP message to a device associated with the device address.

30. The system of claim 29, further comprising means for providing an SNMP response packet from the destination device with network identification information and transmitting the SNMP event packet to a network management station.

31. The system of claim 29, further comprising means for providing an SNMP event packet from the destination device with network identification information and transmitting the SNMP event packet to a network management station.