System using multiple sets of device management policies for managing network devices connected on different network interfaces

• US 7,418,490 B1
• Filed: 12/29/2003
• Issued: 08/26/2008
• Est. Priority Date: 12/29/2003
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Zhang, Peinan C., Kochar, Sonali, Dikhit, Aniruddh S.
• Primary Examiner(s): LUU, LE HIEN
• Application Number:
  US10/748,579
• Time in Patent Office: 1,702 Days
• Field of Search: 709/223, 709/220, 709/251, 709/324, 709/228, 709/224, 714/47, 370/229
• US Class Current: 709/223
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A mechanism for managing network devices using a server with multiple network interfaces includes management agents executing on managed devices, wherein all the agents that share a single instance of a management server, or that are logically partitioned, are said to be in a single “server context”. Each server context can manage devices from any of multiple network interfaces of a server machine, that are associated with a given server context. Managed devices that are registered to be managed as part of a given server context are managed based on policies associated with the server context. Managed devices that are registered to be managed through one network interface of a server context of the management server may be communicatively isolated from managed devices that are registered to be managed through another network interface of the same server context of the management server.

Claims

1. A method for managing a network of devices, the method comprising:

associating a first set of device management policies with a first network interface;

associating a second set of device management policies with a second network interface, wherein the second network interface is different from the first network interface;

registering a first network device, wherein registration includes identifying the first network interface as an interface from which the first network device can be managed;

registering a second network device, wherein registration includes identifying the second network interface as an interface from which the second network device can be managed;

based on the registration of the first network device, managing the first network device based on the first set of management policies; and

based on the registration of the second network device, managing the second network device based on the second set of management policies.

2. The method of claim 1, wherein the second network interface is communicatively isolated from the first network interface.

3. The method of claim 2, wherein the second network interface is logically isolated from the first network interface.

4. The method of claim 1, wherein the first network interface and the second network interface are both associated with the same instance of a management application.

5. The method of claim 1, wherein the first set of management policies is different from the second set of management policies.

6. The method of claim 5, wherein the first set of management policies includes a permission to write to the first network device and the second set of management policies includes a permission to read from but not write to the first network device.

7. The method of claim 1, wherein the first set of management policies is the second set of management policies.

8. The method of claim 1, wherein the first network device is configured on a first network and the second network device is configured on a second network, and wherein the first network is different from the second network.

9. The method of claim 8, wherein the first network is a public network and the second network is a private network, and wherein the first network interface is communicatively uncoupled to the second network interface.

10. The method of claim 1, wherein the first network device and the second network device are configured on a same network.

11. The method of claim 1, further comprising:

associating a third network interface with a set of policies that are not regarding management of devices, wherein registration of the first and second network devices cannot include identifying the third network interface as an interface from which the first or second network devices can be managed.

12. The method of claim 1, further comprising:

validating whether the first network device is manageable through the first network interface by comparing the registration identifying the first network interface as an interface from which the first network device can be managed with information that specifies all network interfaces from which the first network device can be managed.

13. The method of claim 1, wherein the registration of the first network device includes identifying the first network interface as an only interface from which the first network device can be managed, and wherein the registration of the second network device includes identifying the second network interface as an only interface from which the second network device can be managed.

14. A method for registering a managed device for management by a management application executing on a computer system having multiple network interfaces, the method comprising:

identifying a first network interface, of the computer system, that is associated with a first instance of the management application, as an interface from which a first managed device can be managed;

wherein a second managed device identifies a second network interface, of the computer system, that is different than the first network interface and that is associated with the first instance of the management application, as an interface from which the second managed device can be managed; and

responding to management requests that are based on a first set of management policies that is associated with the first network interface.

15. The method of claim 14, wherein the second managed device responds to management requests that are based on a second set of management policies that is associated with the second network interface.

16. The method of claim 15, wherein the first set of management policies is different from the second set of management policies.

17. The method of claim 16, wherein the first set of management policies includes a permission to write to the first managed device and the second set of management policies includes a permission to read from but not write to the first managed device.

18. The method of claim 15, wherein the first set of management policies is the second set of management policies.

19. The method of claim 15, wherein the first managed device is configured on a first network and the second managed device is configured on a second network, and wherein the first network is different from the second network.

20. The method of claim 19, wherein the first network is a public network and the second network is a private network, and wherein the first network interface is communicatively uncoupled to the second network interface.

21. The method of claim 15, wherein the first network device and the second network device are configured on a same network.

22. In a computer system on which one or more applications execute, a computer-readable storage medium comprising instructions which, when executed by one or more processors, cause the one or more processors to manage a network of devices by:

associating a first set of device management policies with a first network interface;

associating a second set of device management policies with a second network interface, wherein the second network interface is different from the first network interface;

registering a first network device, wherein registration includes identifying the first network interface as an interface from which the first network device can be managed;

registering a second network device, wherein registration includes identifying the second network interface as an interface from which the second network device can be managed;

based on the registration of the first network device, managing the first network device based on the first set of management policies; and

based on the registration of the second network device, managing the second network device based on the second set of management policies.

23. The computer-readable storage medium of claim 22, wherein execution of the instructions by the one or more processors causes the one or more processors to further manage a network of devices by:

validating whether the first network device is manageable through the first network interface by comparing the registration identifying the first network interface as an interface from which the first network device can be managed with information that specifies all network interfaces from which the first network device can be managed.

24. In a computer system on which one or more applications execute, a computer-readable storage medium comprising instructions which, when executed by one or more processors, cause the one or more processors to register a managed device for management by a management application executing on a server computer having multiple network interfaces by:

identifying a first network interface, of the server computer, that is associated with a first instance of the management application, as an interface from which a first managed device can be managed;

wherein a second managed device identifies a second network interface, of the server computer, that is different than the first network interface and that is associated with the first instance of the management application, as an interface from which the second managed device can be managed; and

responding to management requests that are based on a first set of management policies that is associated with the first network interface.

25. The computer-readable storage medium of claim 24, wherein the second managed device responds to management requests that are based on a second set of management policies that is associated with the second network interface.

26. The computer-readable storage medium of claim 25, wherein the first set of management policies is different from the second set of management policies.

27. The computer-readable storage medium of claim 25, wherein the first set of management policies is the second set of management policies.

28. The computer-readable storage medium of claim 24, wherein the first network device and the second network device are configured on a same network.

29. The computer-readable storage medium of claim 28, wherein the first network is a public network and the second network is a private network, and wherein the first network interface is communicatively uncoupled to the second network interface.

30. The computer-readable storage medium of claim 24, wherein the first managed device is configured on a first network and the second managed device is configured on a second network, and wherein the first network is different from the second network.

31. An apparatus on which one or more applications execute, the apparatus comprising:

a network interface;

a memory; and

one or more processors connected to the network interface and the memory, the one or more processors configured for

associating a first set of device management policies with a first network interface;

associating a second set of device management policies with a second network interface, wherein the second network interface is different from the first network interface;

registering a first network device, wherein registration includes identifying the first network interface as an interface from which the first network device can be managed;

registering a second network device, wherein registration includes identifying the second network interface as an interface from which the second network device can be managed;

based on the registration of the first network device, managing the first network device based on the first set of management policies; and

based on the registration of the second network device, managing the second network device based on the second set of management policies.

32. An apparatus on which one or more applications execute, the apparatus comprising:

a network interface;

a memory; and

one or more processors connected to the network interface and the memory, the one or more processors configured for

identifying a first network interface, of a multi-interface computer, that is associated with a first instance of the management application, as an interface from which a first managed device can be managed;

wherein a second managed device identifies a second network interface, of the multi-interface computer, that is different than the first network interface and that is associated with the first instance of the management application, as an interface from which the second managed device can be managed; and

responding to management requests that are based on a first set of management policies that is associated with the first network interface.

33. A system for managing a network of devices, the system comprising:

means for associating a first set of device management policies with a first network interface;

means for associating a second set of device management policies with a second network interface, wherein the second network interface is different from the first network interface;

means for registering a first network device, wherein registration includes identifying the first network interface as an interface from which the first network device can be managed;

means for registering a second network device, wherein registration includes identifying the second network interface as an interface from which the second network device can be managed;

means for managing the first network device based on the first set of management policies; and

means for managing the second network device based on the second set of management policies.

34. A system that can register for management by a management application executing on a computer having multiple network interfaces, the system comprising:

means for identifying a first network interface, of the computer, that is associated with a first instance of the management application, as an interface from which the system can be managed;

wherein a second system identifies a second network interface, of the computer, that is different than the first network interface and that is associated with the first instance of the management application, as an interface from which the second managed device can be managed; and

means for responding to management requests that are based on a first set of management policies that is associated with the first network interface.