Remote configuration of devices using a secure connection

• US 20070266121A1
• Filed: 05/09/2006
• Published: 11/15/2007
• Est. Priority Date: 05/09/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Saeed, Arshad, Gohstand, Jonathan, Fanning, Scott
• Granted Patent: US 7,975,030 B2
• Time in Patent Office: Days
• US Class Current: 709/220
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 41/0846 based on copy from other elements
• CPC Class Codes: H04L 41/0859 by keeping history of different configuration generations or by rolling back to previous configuration versions
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Methods and systems for configuring a remote device are described. In one embodiment, a method of configuring a remote device while negotiating a secure connection between the remote device and a central server is described. The method involves transmitting a configuration request from the remote device to the central server, including a request for a location to retrieve the latest configuration file from. The method also entails receiving a configuration response from the central server, with a pointer to such a location. The configuration file is retrieved from the indicated location, and applied to the remote device. The remote device sends general information about its configuration and status to the central server, using the secure connection.

Claims

1. A method of configuring a remote device, said method comprising:

transmitting a configuration request from said remote device, said configuration request comprising a request for a location from which to retrieve a configuration file;

receiving a configuration response into said remote device, said configuration response comprising a pointer to said location to retrieve said configuration file;

retrieving said configuration file from said location; and

applying said configuration file to said remote device.

2. The method of claim 1, wherein said transmitting and said receiving are performed during, and as part of, negotiation of a secure connection to a remote server.

3. The method of claim 1, wherein said configuration request further comprises a request for a current version identifier related to said configuration file.

4. The method of claim 3, wherein said configuration response further comprises said current version identifier.

5. The method of claim 4, further comprising:

comparing said current version identifier with one or more local version identifiers related to one or more local configuration profiles stored on said remote device.

6. The method of claim 5, further comprising:

if said current version identifier matches one of said local version identifiers, applying said local configuration profile associated with said local version identifier.

7. The method of claim 1, further comprising:

creating a checkpoint of a current configuration state of said remote device, before applying said configuration file.

8. A system, comprising:

a bus, for transmitting information;

a processor coupled to said bus, for performing operations;

an operating system running on said processor, for controlling said system; and

an external network connection coupled to said bus, for communicating with a remote server; and

a networking module, for negotiating a secure connection to said remote server, wherein said operating system is configured to transmit a request for a current configuration file to said remote server, said external network connection is configured to receive a pointer to said current configuration file, said operating system is configured to access a location indicated by said pointer, said external network connection is configured to receive said current configuration file, and said processor is configured to perform one or more operations indicated by said current configuration file.

9. The system of claim 8, further comprising:

a memory coupled to said bus, for storing a stored configuration profile, said stored configuration profile having an associated version number, wherein said external network connection receives a version identifier corresponding to said current configuration file, and said processor compares said version identifier with said version number associated with said stored configuration profile.

10. The system of claim 8, wherein said networking module is configured to establish a secure connection to said remote server.

11. The system of claim 10, wherein said secure connection is in compliance with the IPSec networking protocol.

12. The system of claim 11, wherein said operating system is further configured to transmit said request to said remote server during Internet Key Exchange (IKE) negotiation.

13. The system of claim 12, wherein said request is formatted as a Mode-Config parameter.

14. The system of claim 12, wherein said pointer is formatted as a Mode-Config parameter.

15. The system of claim 8, wherein said pointer comprises a Uniform Resource Locator (URL).

16. A system for configuring a spoke device of a hub-spoke network from a network hub, said system comprising:

means for negotiating a secure connection between said spoke device and said network hub;

means for transmitting initial configuration instructions from said network hub; and

means for transmitting a location indicator from said network hub, said location indicator comprising a pointer to a location from which a specific configuration for said spoke device can be retrieved.

17. The system of claim 16, further comprising:

means for receiving a state report from said spoke device.

18. The system of claim 16, wherein said secure connection comprises an IPSec Virtual Private Network (VPN) connection between said network hub and said spoke device.

19. The system of claim 18, wherein said location indicator is formatted as a Mode-Config parameter.

20. The system of claim 16, further comprising:

means for transmitting a version identifier from said network hub, said version identifier associated with said specific configuration.