Policy analyzer

• US 7,409,447 B1
• Filed: 11/20/2003
• Issued: 08/05/2008
• Est. Priority Date: 11/20/2003
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Assadzadeh, Alireza
• Primary Examiner(s): DUONG, OANH L
• Application Number:
  US10/716,484
• Time in Patent Office: 1,720 Days
• Field of Search: 709223-226, 709/229, 726/1, 370/230, 370/230.1, 370/235
• US Class Current: 709/225
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Systems and methods are provided for analyzing policy rules defined for a subscriber and determining packet treatment in a network. Definitions are retrieved pertaining to policy rules for a subscriber. At least one policy point in a network is determined based on the retrieved definitions. The packet treatment is determined at each of the at least one policy point. The packet treatment is shown for each of the at least one policy point. Packets may be injected into the network at injection points and statistics may be collected. The statistics may be compared with results of analyzing policy rules for the subscriber.

Claims

1. A method of analyzing policy rules defined for a subscriber and determining packet treatment, the method comprising:

retrieving definitions pertaining to policy rules for a subscriber;

determining at least one policy point in a network for the subscriber based on the retrieved definitions;

determining the packet treatment at each of the at least one policy point;

outputting information corresponding to the packet treatment for each of the at least one policy point;

determining at least one injection point based on the at least one policy point;

using at least one policy agent to inject packets at the at least one injection point;

collecting statistics from some of the at least one policy agent;

consolidating and correlating the collected statistics; and

displaying results based on the consolidated and correlated statistics.

2. The method of claim 1, further comprising:

consolidating the determined packet treatment for each of the at least one policy point; and

displaying information representing the packet treatment through the network.

3. The method of claim 1, wherein the determining the packet treatment comprises assigning traffic to traffic groups based on ones of the policy rules that are in effect.

4. The method of claim 3, wherein traffic assigned to one of the traffic groups satisfies a same one or more policy rule conditions.

5. The method of claim 3, wherein the determining the packet treatment further comprises:

determining which ones of the policy rules have conditions satisfied by packet input; and

determining which of the policy rules that have conditions satisfied by the packet input are eclipsed.

6. The method of claim 5, wherein the determining which of the policy rules that are eclipsed is based on eclipsing rules defined for a router.

7. The method of claim 1, wherein the determining the packet treatment comprises:

obtaining a list of policy rules defined for a direction of an interface;

sorting the list of policy rules based on a precedence defined for each of the policy rules; and

for each of the sorted policy rules;

determining whether a condition of each one of the sorted policy rules is satisfied by a possible packet input;

for each of the conditions that are satisfied by the possible packet input, adding the corresponding policy rule to an “

in effect”

list of the policy rules;

for each of the conditions that are not satisfied by the possible packet input, adding the corresponding policy rule to an “

ignore”

list of the policy rules; and

determining which ones of the policy rules from the “

in effect”

list are eclipsed and moving ones of the policy rules that are eclipsed to an “

eclipsed”

list of the policy rules.

8. The method of claim 7, further comprising performing, for each of the sorted policy rules, determining which ones of the policy rules from the “

in effect”

list can be combined and rearranging an order of the sorted “

in effect”

list of the policy rules based on a definition of permissible combined actions.

9. One or more devices for analyzing packet treatment in a network, the one or more devices comprising:

a user input/output interface configured to receive input from a user interface and to send output to the user interface;

a database interface configured to access definitions in the database;

a management server interface configured to request and receive information from a management server;

a network interface configured to request and receive information from devices in the network;

an agent interface configured to send commands to at least one agent and to receive information from the at least one agent, command one or more of the at least one agent to inject packets into a network and collect statistics; and

analyzer logic configured to analyze packet treatment based on policy rules defined for a subscriber,

wherein the analyzer logic is configured to;

determine one or more policy points in a network based on the defined policy rules,

analyze the packet treatment at each of the one or more policy points based on the defined policy rules,

send analysis results via the user input/output interface, and

consolidate and correlate the collected statistics.

10. The one or more devices of claim 9, wherein the analyzer logic is configured to use policy rule definitions defined for a subscriber when performing analysis.

11. The one or more devices of claim 10, wherein the analyzer logic is further configured to analyze possible traffic on an interface and determine traffic groups for portions of the possible traffic.

12. The one or more devices of claim 10, wherein the analyzer logic is further configured to analyze possible packet input on an interface and determine actions to be taken based on the defined policy rules.

13. The one or more devices of claim 9, wherein the one or more devices are configured to command, via the agent interface, one or more agents to inject packets into a network.

14. A system for analyzing packet treatment in a network, the system comprising:

a management server configured to load policy rules and service definitions to a router when a subscriber session is established;

a database including definitions of policy rules, the service definitions, and a network configuration, the database being configured to be accessible by the management server;

a policy analyzer configured to analyze packet treatment based on ones of the policy rules and the service definitions defined for a subscriber, the policy analyzer being configured to access the management server and the database;

a policy analyzer agent configured to receive commands from the policy analyzer to inject packets into a network at an injection point,

wherein the policy analyzer agent is further configured to collect statistics regarding traffic injected at the injection point and to send the collected statistics to the policy analyzer; and

a user input/output interface configured to provide input to the policy analyzer and receive analysis results from the policy analyzer.

15. The system of claim 14, wherein the policy analyzer is configure to determine a plurality of traffic groups based on the ones of the policy rules and the service definitions defined for a subscriber.

16. One or more network devices, comprising:

an analyzer interface configured to receive commands from a policy analyzer and send information to the policy analyzer, the policy analyzer configured to determine at least one injection point for injecting traffic;

an injector for injecting traffic into at the at least one injection point upon receiving a command from the policy analyzer via the analyzer interface; and

a statistics module configured to collect statistics of the injected traffic, the statistics module being further configured to send the collected statistics to a policy analyzer via the analyzer interface.

17. The one or more network devices of claim 16, wherein the one or more network devices include a router.