Network configuration manager

• US 7,150,037 B2
• Filed: 06/08/2001
• Issued: 12/12/2006
• Est. Priority Date: 03/21/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: Intelliden, Inc. (International Business Machines Corporation)
• Inventors: Haag, Michael D., Wolf, Jonathan S., Whitworth, Robin M., Del Vecchio, Brian A., Anderson, Christopher B., Tackabury, Wayne F., Mellor, Arthur B.
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Parthasarathy, Pramila
• Application Number:
  US09/877,209
• Publication Number:
  US 20020178380A1
• Time in Patent Office: 2,013 Days
• Field of Search: 713/201, 370/254, 726 3- 6, 726/17
• US Class Current: 726/6
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A policy engine generates configlets that are vendor-neutral, vendor-specific or both, based on a selected target level and a selected device/device group. A translator translates and combines the configlets to form vendor-dependent configuration files. The policy engine generates the configlets using policies associated with the selected target level and its sub-target levels, as defined by a target level hierarchy. A policy includes at least a condition, and an action which the policy engine performs if the condition is true. In performing the action, the policy engine typically writes to at least a partial configlet. A policy may further include a verification clause, which is used to verify a running configuration. Policy dependencies may also be defined such that where a second policy is dependent on a first policy, the second policy must be evaluated after the first policy. This is necessary, where, for example, the first policy generates and stores a value to be used by the second policy. Policies are small programs. A configlet hierarchy is defined, such that a child configlet inherits properties which it does not define from its parent. A mapping function maps infrastructure data in a first format to a second format, so that the second format is recognizable by the policy engine. A loader batches, schedules and loads a configuration file to its intended device. Upon replacing a first device using a first configuration format with a second device using a second configuration format, the first device'"'"'s configuration is read in or uploaded and reverse-translated into configlets. The configlets are then translated into a configuration formatted for the second device. The system retains device logins and passwords in encrypted format. A user desiring to connect to a device must log in to the system instead. The system in turn logs in or connects to the device and passes information back and forth between the user and the device, as if the user were logged directly into the device.

Claims

1. A network configuration management system comprising:

a reverse translator configured to receive a first vendor-specific configuration file from a first network device and configured to reverse translate the first vendor-specific configuration tile into at least one vendor-neutral configlet;

a configuration file generator configured to generate a second vendor-specific configuration file using the at least one vendor-neutral configlet, the second vendor-specific configuration file corresponding to a second network device; and

a loader for loading the second vendor-specific configuration file to the second network device;

wherein the first vendor-specific configuration file is usable to configure the operation of the first network device and the second vendor-specific configuration file is usable to configure the operation of the second network device;

a translator which translates the at least one of the plurality of vendor-neutral configlet to a vendor-specific configlet.

2. The system of claim 1, wherein the plurality of vendor-neutral configlets are organized based on a selected feature set target level.

3. The system of claim 1, wherein the system retains login information to the devices, such that a user desiring to connect to a device must log in to the system, the system connecting to the device.

4. The system of claim 3, wherein the system passes commands from the user to the device, and responses from the device to the user.

5. The system of claim 1, wherein the second vendor-specific configuration file comprises a full configuration.

6. The system of claim 1, wherein the second vendor-specific configuration file comprises a partial configuration.

7. The system of claim 1, wherein the first vendor-specific configuration file comprises a full configuration.

8. The system of claim 1, wherein the first vendor-specific configuration file comprises a partial configuration.