Method and apparatus for defining and enforcing policies for configuration management in communications networks

• US 5,872,928 A
• Filed: 05/25/1995
• Issued: 02/16/1999
• Est. Priority Date: 02/24/1995
• Status: Expired due to Term

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Cabletron Systems Incorporated (Extreme Networks, Inc.)
• Inventors: Lewis, Lundy, Scott, Walter, Malik, Rajiv, Rustici, Eric, Thebaut, Suzanne, Kaikini, Prasan, Sycamore, Steve
• Primary Examiner(s): Lall, Parshotam S.
• Assistant Examiner(s): Coulter, Kenneth R.
• Application Number:
  US08/450,854
• Time in Patent Office: 1,363 Days
• Field of Search: 395/200, 395/200.5, 395/200.51, 395/200.32
• US Class Current: 709/222
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 41/0846 based on copy from other elements
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/0866 Checking the configuration
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/20 Network management software packages

Abstract

Apparatus and method for monitoring parameters that govern the operational characteristics of a network device, including the use of templates for generating configuration records of network devices of a selected model type. A database of models is provided, each model representing an associated network device and including attribute values for the parameters of the associated network device. Templates are used to screen a model in order to retrieve values for each of the attributes and create a configuration record. The configuration records may be stored in the configuration manager or other storage device, and/or transferred to the pre-existing model database for use by a network management system in reconfiguring the associated network devices. Additionally, a method and apparatus is provided that defines network groups, defines network policies for groups, determines conflicts, and resolves conflicts among groups and devices. This system for configuration management is less time consuming, expensive, and error prone than prior systems.

Claims

1. A method for managing configurations of network devices connected in a network comprising the steps of:

grouping at least one network device to create a network group;

applying a policy to the network group by modifying a database to associate a configuration record with the network group, the step of applying a policy including the steps of;

applying a first policy having a first ordering index to the network group;

applying a second policy having a second ordering index to the network group; and

loading, over the network, a configuration described by the configuration record into each network device in the network group, the step of loading including loading a first configuration defined by the first policy and a second configuration defined by the second policy in an order defined by the first ordering index and the second ordering index.

2. The method of claim 1, wherein the step of grouping includes the steps of:

selecting the at least one network device; and

modifying the database to include a group identifier and an association between the group identifier and each of the at least one network device.

3. The method of claim 2, wherein the step of selecting includes selecting an existing group that includes the at least one network device.

4. The method of claim 1, wherein the step of applying a policy includes the step of applying a policy to a second group of which the network group is a member.

5. The method of claim 1, wherein the step of loading the configuration includes the steps of:

when the first ordering index has a value that is less than the second ordering index;

loading the first configuration into each network device in the network group; and

subsequently loading the second configuration into each network device in the network group; and

when the second ordering index has a value that is less than the first ordering index;

loading the second configuration into each network device in the network group; and

subsequently loading the first configuration described into each network device in the network group.

6. The method of claim 1, wherein the step of applying a policy includes applying a policy having a condition, and wherein the step of loading includes the steps of:

determining whether the condition is satisfied; and

loading the configuration described by the configuration record into each network device in the network group when the condition is satisfied.

7. The method of claim 1, further comprising the steps of:

triggering an enforcement;

determining whether any conflicts exist among policies that are applied to the network group;

when the step of determining determines that conflicts exist, resolving the conflicts that exist.

8. A method for enforcing policies that apply to a device in a network, the method comprising the steps of:

triggering an enforcement;

determining whether any conflicts exist among policies that are applied to the network, the step of determining whether any conflicts exist including the steps of;

determining at least one group of which the device is a member;

determining applicable policies for the at least one group, the applicable policies each having a configuration record that includes attributes associated with attribute values; and

determining whether a first applicable policy of the applicable policies has a first configuration record that includes a first value associated with a first attribute, and a second applicable policy of the applicable policies has a second configuration record that includes a second value associated with the first attribute, a conflict existing when the second value is different from the first value;

when the step of determining determines that a conflict exists, resolving the conflict.

9. The method of claim 8, wherein the step of triggering includes the steps of:

selecting a trigger event; and

triggering according to the trigger event.

10. The method of claim 9, wherein the step of triggering includes determining at least one of:

when a device on the network has been activated;

when a device on the network has been deactivated;

when the network has been activated;

when the network has been deactivated

when a device has been added to the network;

when a scheduler has determined the trigger event; and

when a user has manually triggered the trigger event.

11. The method of claim 8, wherein the step of determining applicable policies for the group includes the steps of:

searching a database to determine a plurality of policies that are associated in the database with the group;

characterizing each of the plurality of policies as one of a policy having a condition and a policy having no conditions;

characterizing each of the plurality of policies having a condition as one of a policy having a satisfied condition and a policy having an unsatisfied condition; and

determining the applicable policies to be each policy having a satisfied condition and each policy having no conditions.

12. The method of claim 8, wherein the step of resolving includes the steps of:

selecting a resolution strategy; and

selecting a policy from a plurality of applicable policies according to the resolution strategy.

13. The method of claim 12, wherein the step of selecting a resolution strategy includes selecting one of:

a most specific group strategy that includes selecting an applicable policy that more specifically defines a policy of the device than the other of the plurality of applicable policies;

a least specific group strategy that includes selecting an applicable policy that less specifically defines a policy of the device than the other of the plurality of applicable policies;

a most conditions satisfied strategy that includes selecting from the plurality of applicable policy an applicable policy that includes a largest number of satisfied conditions; and

a user adjudication strategy that includes enabling a user to select a policy from the plurality of applicable policies.

14. The method of claim 8, wherein the step of resolving includes the steps of:

selecting a resolution strategy; and

selecting a configuration record from a plurality of applicable configuration records according to the resolution strategy.

15. The method of claim 14, wherein the step of selecting a resolution strategy includes selecting one of:

a most specific group strategy that includes selecting an applicable configuration record that more specifically defines a configuration of the device than the other of the plurality of applicable policies;

a least specific group strategy that includes selecting an applicable configuration record that less specifically defines a configuration of the device than the other of the plurality of applicable policies;

a most conditions satisfied strategy that includes selecting from the plurality of applicable configuration records an configuration record that includes a largest number of satisfied conditions; and

a user adjudication strategy that includes enabling a user to select a configuration record from the plurality of applicable configuration records.

16. The method of claim 8, further comprising a step of providing an output.

17. The method of claim 16, wherein the step of providing an output includes the steps of:

creating an enforceable configuration report; and

loading a configuration associated with the enforceable configuration report into the device.

18. The method of claim 16, wherein the step of providing an output includes creating a conflict notice.

19. The method of claim 16, wherein the step of providing an output includes creating a notice that no action is needed.

20. The method of claim 16, wherein the step of providing an output includes creating a configuration report that defines an overall configuration of the network.

21. An apparatus for managing configurations of network devices connected in a network comprising:

a database that includes an association of a configuration record with at least one network device in a network group, the database including;

an association of a first policy having a first ordering index with the network group; and

an association of a second policy having a second ordering index with the network group; and

means for loading, over a network, a configuration described by the configuration record into each network device in the network group, the means for loading including means for loading a first configuration defined by the first policy and a second configuration defined by the second policy in an order defined by the first ordering index and the second ordering index.

22. The apparatus of claim 21, further comprising:

means for selecting the at least one network device;

means for modifying the database to include a group identifier and an association between the group identifier and each of the at least one network device.

23. The apparatus of claim 22, wherein the means for selecting includes means for selecting an existing group that includes the at least one network device.

24. The apparatus of claim 21, wherein the database includes a second association that associates a policy with a second group of which the network group is a member.

25. The apparatus of claim 21, wherein the means for loading the configurations includes:

means for loading the first configuration into each network device in the network group, and for subsequently loading the second configuration into each network device in the network group when the first ordering index has a value that is less than the second ordering index; and

means for loading the second configuration into each network device in the network group, and for subsequently loading the first configuration into each network device in the network group when the second ordering index has a value that is less than the first ordering index.

26. The apparatus of claim 21, wherein the database includes an association of a policy having a condition, and wherein the means for loading includes:

means for determining whether the condition is satisfied; and

means for loading the configuration described by the configuration record into each network device in the network group when the condition is satisfied.

27. The apparatus of claim 21, further comprising:

a trigger;

an inference engine, responsive to the trigger, that determines whether any conflicts exist among policies that are applied to the network group, and resolves the conflicts that exist.

28. An apparatus for enforcing policies that apply to a device in a network, the apparatus comprising:

a trigger;

an inference engine that determines whether any conflicts exist among policies that are applied to the network and resolves the conflicts that exist, the inference engine including;

means for determining at least one group of which the device is a member;

means for determining applicable policies for the at least one group, the applicable policies each having a configuration record that includes attributes associated with attribute values; and

means for determining whether a first applicable policy of the applicable policies has a first configuration record that includes a first value associated with a first attribute, and a second applicable policy of the applicable policies has a second configuration record that includes a second value associated with the first attribute, wherein a conflict exists if the second value is different from the first value.

29. The apparatus of claim 28, wherein the trigger includes:

a selected trigger event; and

means for triggering according to the selected trigger event.

30. The apparatus of claim 29, wherein the means for triggering includes means for determining at least one of:

when a device on the network has been activated;

when a device on the network has been deactivated;

when the network has been activated;

when the network has been deactivated;

when a device has been added to the network;

when a scheduler has determined the trigger event; and

when a user has manually triggered the trigger event.

31. The apparatus of claim 28, wherein the means for determining applicable policies for the group includes:

means for searching a database to determine a plurality of policies that are associated in the database with the group;

means for characterizing each of the plurality of policies as one of a policy having a condition and a policy having no conditions;

means for characterizing each of the plurality of policies having a condition as one of a policy having a satisfied condition and a policy having an unsatisfied condition; and

means for determining the applicable policies to be each policy having a satisfied condition and each policy having no conditions.

32. The apparatus of claim 28, wherein the inference engine includes:

means for selecting a resolution strategy; and

means for selecting a policy from a plurality of applicable policies according to the resolution strategy.

33. The apparatus of claim 32, wherein the means for selecting a resolution strategy includes means for selecting one of:

a most specific group strategy that includes selecting an applicable policy that more specifically defines a policy of the device than the other of the plurality of applicable policies;

a least specific group strategy that includes selecting an applicable policy that less specifically defines a policy of the device than the other of the plurality of applicable policies;

a most conditions satisfied strategy that includes selecting from the plurality of applicable policy an applicable policy that includes a largest number of satisfied conditions; and

a user adjudication strategy that includes enabling a user to select an applicable policy from the plurality of policies.

34. The apparatus of claim 28, wherein the inference engine includes:

means for selecting a resolution strategy; and

means for selecting a configuration record from a plurality of applicable configuration records according to the resolution strategy.

35. The apparatus of claim 34, wherein the means for selecting a resolution strategy includes means for selecting one of:

a most specific group strategy that includes selecting an applicable configuration record that more specifically defines a configuration of the device than the other of the plurality of applicable configuration records;

a least specific group strategy that includes selecting an applicable configuration that less specifically defines a configuration of the device than the other of the plurality of applicable configuration records;

a most conditions satisfied strategy that includes selecting from the plurality of applicable configuration records an applicable configuration record that includes a largest number of satisfied conditions; and

a user adjudication strategy that includes enabling a user to select a configuration record from the plurality of applicable configuration records.

36. The apparatus of claim 28, wherein the inference engine has an output that includes an enforceable configuration report.

37. The apparatus of claim 36, further comprising means for loading a configuration associated with the enforceable configuration report into the device.

38. The apparatus of claim 28, wherein the inference engine has an output that includes a conflict notice.

39. The apparatus of claim 28, wherein the inference engine has an output that includes a notice that no action is needed.

40. The apparatus of claim 28, wherein the inference engine has an output that includes a configuration report that defines an overall configuration of the network.