MANAGING NETWORK DEVICES

• US 20130198348A1
• Filed: 02/05/2013
• Published: 08/01/2013
• Est. Priority Date: 04/30/2009
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Zuk, Nir, Ithal, Ravi, Bharali, Anupam
• Granted Patent: US 9,491,047 B2
• Time in Patent Office: Days
• US Class Current: 709/220
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for managing network devices. A central management system stores shared configuration objects in a central configuration database. A network device stores shared configuration objects and device-specific configuration objects in a local configuration database. The local configuration database'"'"'s shared configuration objects correspond to shared configuration objects in the central configuration database. The network device can be configured locally or using the central management system.

Claims

1. (canceled)

3. The method of claim 1, wherein in the event that the shared configuration object is determined to be irrelevant, storing the new value in the local configuration data store.

4. The method of claim 1, wherein in the event that the shared configuration object is determined to be irrelevant, sending an error message associated with the request to the central management system.

5. The method of claim 1, wherein in the event that the shared configuration object is determined to be irrelevant, discarding the new value.

6. The method of claim 1, wherein determining whether the shared configuration object is relevant is based at least in part on comparing the shared configuration object with a list of relevant configuration objects.

7. The method of claim 1, wherein:

the first network device comprises a routing device; and

the shared configuration object comprises a Domain Name Service (DNS) server address.

8. The method of claim 1, wherein the first network device is selected by the central management system to which to send the request based at least in part on the shared configuration object not being stored in the local configuration data store.

9. The method of claim 1, wherein the first network device comprises a security device or a Virtual Private Network (VPN) server.

10. The method of claim 1, wherein the first network device is configured to select a configuration object from a plurality of configuration objects stored in the local configuration data store based on a priority list in order to process a first packet, wherein the priority list comprises a processing order for the plurality of configuration objects.

2. A method performed by a first network device for configuring the first network device using a central management system, the method comprising:

receiving a request originating from the central management system to update a respective value of a shared configuration object that is not stored in a local configuration data store associated with the first network device with a new value; and

determining whether the shared configuration object is relevant, in the event that the shared configuration object is determined to be relevant, creating a new configuration object corresponding to the shared configuration object in the local configuration data store and updating the new configuration object with the new value.

11. A system, comprising:

a first network device comprising one or more processors and one or more network interfaces;

wherein the first network device has encoded on a non-transitory computer-readable medium instructions operable to cause one or more of the processors of the first network device to perform operations comprising;

receiving a request originating from the central management system to update a respective value of a shared configuration object that is not stored in a local configuration data store associated with the first network device with a new value; and

determining whether the shared configuration object is relevant, in the event that the shared configuration object is determined to be relevant, creating a new configuration object corresponding to the shared configuration object in the local configuration data store and updating the new configuration object with the new value.

12. The system of claim 11, wherein in the event that the shared configuration object is determined to be irrelevant, storing the new value in the local configuration data store.

13. The system of claim 11, wherein in the event that the shared configuration object is determined to be irrelevant, sending an error message associated with the request to the central management system.

14. The system of claim 11, wherein in the event that the shared configuration object is determined to be irrelevant, discarding the new value.

15. The system of claim 11, wherein determining whether the shared configuration object is relevant is based at least in part on comparing the shared configuration object with a list of relevant configuration objects.

16. The system of claim 11, wherein:

the first network device comprises a routing device; and

the shared configuration object comprises a Domain Name Service (DNS) server address.

17. The system of claim 11, wherein the first network device is selected by the central management system to which to send the request based at least in part on the shared configuration object not being stored in the local configuration data store.

18. The system of claim 11, wherein the first network device comprises a security device or a Virtual Private Network (VPN) server.

19. The system of claim 11, wherein the first network device is configured to select a configuration object from a plurality of configuration objects stored in the local configuration data store based on a priority list in order to process a first packet, wherein the priority list comprises a processing order for the plurality of configuration objects.

20. A computer program product, encoded on a computer-readable storage device, operable to cause a first network device to perform operations comprising:

receiving a request originating from the central management system to update a respective value of a shared configuration object that is not stored in a local configuration data store associated with the first network device with a new value; and

determining whether the shared configuration object is relevant, in the event that the shared configuration object is determined to be relevant, creating a new configuration object corresponding to the shared configuration object in the local configuration data store and updating the new configuration object with the new value.

21. The computer program product of claim 20, wherein in the event that the shared configuration object is determined to be irrelevant, storing the new value in the local configuration data store.

22. The computer program product of claim 20, wherein in the event that the shared configuration object is determined to be irrelevant, sending an error message associated with the request to the central management system.