Systems and methods for managing networks

• US 20050240990A1
• Filed: 04/22/2004
• Published: 10/27/2005
• Est. Priority Date: 04/22/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Goltz, Keren, Lior, Linda, Kurtz, Adi, Ben-Zew, Uri, Hagege, Adina, Trutner, Oren, Ein-Gil, Boaz
• Granted Patent: US 7,725,921 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

The described systems and methods are directed at managing networks using network templates. Each network template is associated with a different network topology and includes parameters for implementing the associated network topology. A user may implement a particular network topology by selecting a corresponding network template. A configurator may be used to configure a network device to implement the network topology associated with the selected network template based, at least in part, on the parameters.

Claims

1. A method for managing networks comprising:

providing a plurality of network templates, each network template associated with a different network topology and including parameters for implementing the associated network topology;

enabling a selection of at least one of the network templates; and

upon receiving a selection, configuring a network device to implement the network topology associated with the selected network template based, at least in part, on the parameters.

2. The method as recited in claim 1, wherein the network device is a firewall.

3. The method as recited in claim 1, wherein the parameters associated with the selected network template include at least one of network identifiers, grouping, relationship, and policy.

4. The method as recited in claim 1, further comprising:

determining addresses associated with private networks included in the selected network template; and

configuring the network device with the addresses.

5. The method as recited in claim 4, wherein the private networks include at least one of an internal network, a perimeter network, a DMZ network, a departmental network, a virtual private network (VPN), and an intranet.

6. The method as recited in claim 1, further comprising:

enabling a selection of at least one policy from a set of policies associated with the selected network templates; and

upon receiving a selection, configuring the network device with the selected policy.

7. The method as recited in claim 6, further comprising customizing the selected network template with the selected policy.

8. The method as recited in claim 1, wherein the network topologies associated with the plurality of network templates include at least one of an edge firewall, a 3-Leg demilitarized zone (DMZ), a front firewall, a back firewall, a departmental firewall, a branch office, and a line filter.

9. One or more computer-readable memories containing instructions that are executable by a processor to perform the method recited in claim 1.

10. A method for configuring a firewall comprising:

presenting a plurality of network templates for selection, each network template including parameters associated with a particular network topology;

upon receiving a selection, determining addresses associated with private networks coupled to the firewall; and

configuring the firewall to implement the network topology in accordance with the parameters included in the selected network template and the addresses.

11. The method as recited in claim 10, further comprising:

presenting a plurality of security policies associated with the selected network template for selection; and

upon receiving a selection of at least one of the security policies, configuring the firewall to implement the selected security policy.

12. The method as recited in claim 10, further comprising:

determining at least one security policy associated with the selected network template; and

automatically configuring the firewall to implement the determined security policy.

13. A system comprising:

a firewall coupled to a plurality of private networks and an external network; and

a configurator coupled to the firewall, the configurator including a plurality of network templates having parameters associated with a particular network topology, the configurator being programmed to enable a selection of at least one of the network templates and to configure the firewall with the parameters associated with the selected network template.

14. The system as recited in claim 13, wherein the configurator is programmed to determine addresses associated with the private networks and to configure the firewall with the addresses.

15. The system as recited in claim 13, wherein the configurator is programmed to determine the addresses from user input.

16. The system as recited in claim 13, wherein the configurator is programmed to determine security policies associated with a selected network template and to apply at least one of the security policies to configure the firewall.

17. The system as recited in claim 16, wherein the configurator is programmed to enable a user selection of the at least one security policy.

18. The system as recited in claim 13, wherein the configurator is programmed to automatically apply a default security policy associated with the selected network template.

19. The system as recited in claim 13, wherein the private networks include at least one of an internal network, a perimeter network, a DMZ network, a departmental network, a virtual private network (VPN), and an intranet.

20. The system as recited in claim 13, wherein the external networks include at least one of a wide area network (WAN) and the Internet.

21. A computer-readable medium encoded comprising:

a data structure representing a plurality of network templates, wherein each network template is associated with a different network topology and includes information for implementing the associated network topology with a firewall.

22. The computer-readable medium as recited in claim 21, wherein the information in the data structure includes network identifiers representing networks and network nodes that are included in a network topology associated with at least one of the network template.

23. The computer-readable medium as recited in claim 21, wherein the information in the data structure includes grouping identifiers representing groups of networks in a network topology associated with at least one of the network template.

24. The computer-readable medium as recited in claim 21, wherein the information in the data structure includes relationship identifiers representing how networks in a network topology associated with at least one of the network template relate and interact with each other.

25. The computer-readable medium as recited in claim 21, wherein the information in the data structure includes security policies related to a network topology associated with at least one of the network templates.

26. The computer-readable medium as recited in claim 21, wherein the information in the data structure includes data for presenting at least one of the network templates in a user interface.

27. The computer-readable medium as recited in claim 21, wherein the data structure is in extensible markup language (XML).

28. A method for handling networking information in a user interface comprising:

graphically presenting a plurality of network templates on the user interface, each network template including parameters associated with a particular network topology;

enabling a selection of at least one of the network templates;

providing a utility for inputting information for implementing the network topology associated with the selected network template; and

graphically presenting information associated with the implemented network topology.

29. The method as recited in claim 28, wherein graphically presenting the plurality of network templates on the user interface includes presenting a graph that illustrates the network topology associated with each network templates.

30. The method as recited in claim 28, wherein the wizard utility enables the input of at least one of addresses associated private networks, security policy selection, and information for customizing at least one of the network templates.