Network configuration manager

• US 7,472,412 B2
• Filed: 05/30/2006
• Issued: 12/30/2008
• Est. Priority Date: 03/21/2001
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: Intelliden, Inc. (International Business Machines Corporation)
• Inventors: Haag, Michael D., Wolf, Jonathan S., Whitworth, Robin M., Del Vecchio, Brian A., Anderson, Christopher B., Tackabury, Wayne F., Mellor, Arthur B.
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US11/442,885
• Publication Number:
  US 20060242690A1
• Time in Patent Office: 945 Days
• Field of Search: None
• US Class Current: 726/6
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A policy engine generates configlets that are vendor-neutral, vendor-specific or both, based on a selected target level and a selected device/device group. A translator translates and combines the configlets to form vendor-dependent configuration files. The policy engine generates the configlets using policies associated with the selected target level and its sub-target levels, as defined by a target level hierarchy. A policy includes at least a condition, and an action which the policy engine performs if the condition is true. In performing the action, the policy engine typically writes to at least a partial configlet. A policy may further include a verification clause, which is used to verify a running configuration. Policy dependencies may also be defined such that where a second policy is dependent on a first policy, the second policy must be evaluated after the first policy. This is necessary, where, for example, the first policy generates and stores a value to be used by the second policy. Policies are small programs written as small programs. A configlet hierarchy is defined, such that a child configlet inherits properties which it does not define from its parent. A mapping function maps infrastructure data in a first format to a second format, so that the second format is recognizable by the policy engine. A loader batches, schedules and loads a configuration file to its intended device. Upon replacing a first device using a first configuration format with a second device using a second configuration format, the first device'"'"'s configuration is read in or uploaded and reverse-translated into configlets. The configlets are then translated into a configuration formatted for the second device. The system retains device logins and passwords in encrypted format. A user desiring to connect to a device must log in to the system instead. The system in turn logs in or connects to the device and passes information back and forth between the user and the device, as if the user were logged directly into the device.

Claims

1. A network configuration management system comprising:

a policy engine which evaluates at least one policy and generates configlets for a selected device, wherein configlets are data structures representing a result of the at least one policy, configlets further describing at least one attribute of the selected device; and

a combiner which combines the configlets to form at least one configuration file for uploading to the selected device, the at least one configuration file having a set of instructions specifying at least one behavior of the selected device.

2. The system of claim 1, wherein at least one of the configlets is vendor-neutral, further comprising:

a translator which translates the at least one vendor-neutral configlet to a vendor-specific configlet.

3. The system of claim 1, wherein at least one of the configlets is vendor-specific.

4. The system of claim 1, wherein the configlets are generated based on a selected feature set target level.

5. The system of claim 4, wherein the policy engine generates the configlets using policies associated with the selected target level.

6. The system of claim 5, further comprising:

a target hierarchy, wherein the policy engine generates the configlets using policies associated with the selected target level and its sub-target levels, as defined by the target hierarchy.

7. The system of claim 5, wherein a policy comprises:

a condition; and

an action which the policy engine performs if the condition is true.

8. The system of claim 7, wherein the policy action performed by the policy engine causes the policy engine to write to at least a partial configlet.

9. The system of claim 5, wherein a policy further comprises:

a verification clause.

10. The system of claim 9, wherein the verification clause is used to verify a configuration.

11. The system of claim 10, further comprising:

a reverse-translator which produces configlets from a configuration file, wherein the verification clause verifies the configuration file by examining configlets produced by the reverse-translator.

12. The system of claim 11, wherein the configuration is from a running network device.

13. The system of claim 7, wherein a policy further comprises:

documentation.

14. The system of claim 13, wherein the policy documentation comprises:

a reason; and

a description.

15. The system of claim 5, wherein a second policy is dependent on a first policy, requiring that the second policy be evaluated after the first policy.

16. The system of claim 15, wherein the first policy generates and stores a value to be used by the second policy.

17. The system of claim 5, wherein a policy is written in a programming language.

18. The system of claim 17, wherein the programming language is Perl with extensions.

19. The system of claim 1, further comprising:

a configlet hierarchy, wherein a child configlet inherits properties which is does not define from its parent.

20. The system of claim 1, further comprising:

a mapping function for mapping infrastructure data in a first format to a second format, the second format being recognizable by the policy engine.

21. The system of claim 1, further comprising:

a loader for loading a configuration file to its intended device.

22. The system of claim 21, further comprising:

a scheduler for scheduling the loading of a configuration to its intended device.

23. The system of claim 21, wherein multiple configurations are batched together to be scheduled for loading to their intended devices.

24. The system of claim 1, wherein a device is one of the group comprising:

a router, a switch, a bridge, a firewall, a hub, an interface, a web hosting server, a DNS server and a virtual interface.