Network system, network management server, and access filter reconfiguration method

• US 8,081,640 B2
• Filed: 08/18/2008
• Issued: 12/20/2011
• Est. Priority Date: 10/24/2007
• Status: Expired due to Fees

• Current Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Original Assignee: Hitachi, Ltd.
• Inventors: Ozawa, Yoji, Okita, Hideki
• Primary Examiner(s): Ngo, Ricky
• Assistant Examiner(s): LIU, BEN H
• Application Number:
  US12/222,841
• Publication Number:
  US 20090109970A1
• Time in Patent Office: 1,219 Days
• Field of Search: 370/389, 370/396, 709/225, 726 11- 13
• US Class Current: 370/396
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 45/02 Topology update or discovery

Abstract

Provided is a network system, comprising: a plurality of network devices; a network constructed from the plurality of network devices; and a management server managing the network. The plurality of network devices include a first network device in which a filter assigned as a target of reconfiguration is set and a second network device coupled at a lower level of the first network device. The management server obtains topology of the network from the plurality of network devices; reconfigures, by referring to the obtained network topology, the filters of the first and second network device such that a range in which a packet can be forwarded through a reconfiguring filter set in the first network device is made equal to a range in which a packet can be forwarded through the filter set in the second network device; and sets the reconfigured filters into the network devices.

Claims

1. A network system, comprising:

a plurality of network devices for forwarding a packet;

a network constructed from the plurality of network devices; and

a management server coupled to the network and managing the network, wherein;

the plurality of network devices include a first network device having one or more filters and a second network device coupled at a lower level of the network constructed from the plurality of network devices than the first network device such that the second network device is located closer to a terminal end of the network than the first network device along a path from an external network through the first network device; and

the management server is configured to;

determine a number of the one or more filters of the first network device to assign as a target of reconfiguration based on a load of a processor of the first network device;

obtain topology of the network from the plurality of network devices;

reconfigure, by referring to the obtained network topology, a filter of the first network device that is assigned as a target of reconfiguration and a filter of the second network device such that a range in which packets can be forwarded through reconfiguring filter set in the first network device is distributed to the second network device; and

set the reconfigured filters into the first network device and the second network device to configure the second network device to forward packets through the range in which packets were forwarded through the reconfiguring filter of the first network device.

2. The network system according to claim 1 wherein the management server is configured to:

identify, among network devices directly coupled to the first network device, a second network device for accommodating a source terminal included in a condition of the filter assigned as the target of reconfiguration;

specify a port of the second network device, which is coupled to the first network device, as a port in which the filter is to be set;

determine whether the range in which a packet can be forwarded through the filter set in the second network, device is equal to the range in which a packet can be forwarded through the filter set in the first network device; and

reconfigure, in the case of which the ranges in which a packet can be forwarded are determined as not equal to each other, the lifter of the second network device such that a permission filter whose source address is a source address contained in the condition of the filter assigned as the target of reconfiguration set in the first network device and whose destination address is a terminal accommodated in the first network device and not accommodated in the second network device is set in the specified port.

3. The network system according to claim 2, wherein:

the management server is further configured to determine the number of filters assigned as targets of reconfiguration by at least one of the following methods (1) and (2);

(1) load information of the processor of the first network device is obtained from the first network device, and then the number of filters assigned as targets of reconfiguration is determined according to the obtained load information of the processor based on a comparison result between the obtained load information and a predetermined threshold; and

(2) the number of filters specified through an interface provided in the management server is determined as the number of filters assigned as targets of reconfiguration; and

reconfigure the determined number of filters.

4. The network system according to claim 2, wherein the management server is configured to:

manage information concerning a type of the filter set in the first network device;

determine to priority of the filter assigned as a target of reconfiguration by at least one of the following methods (1) and (2);

(1) the type of the filter sot in the first network device is judged with reference to the managed information concerning the type of the filter, and then the priority of the filter assigned as a target of reconfiguration is determined according to the judged type of the filter; and

(2) a priority for the filter specified through an interface provided in the management server is determined as the priority of the filter assigned as a target of reconfiguration; and

select, based on the determined priority;

a filter to be assigned as a target of reconfiguration.

5. The network system according to claim 2, wherein:

the network topology includes physical coupling information of the network and logical coupling information of the network; and

the management server is configured to use the network topology to select a second network device coupled at a lower level of the first network device.

6. The network system according to claim 2, wherein:

the management server comprises an interface for receiving specification of the filter assigned as a target of reconfiguration and a network device and a port before the reconfiguration of the filter, and a request of reconfiguration of the filter and setting into a real network device; and

the management server is configured to reconfigure the filter of the network device and the port specified through the interface.

7. The network system according to claim 2, wherein:

the plurality of network devices further include a third network device coupled at a lower level of the second network device; and

the management server is configured to;

newly specify as a filter assigned as a target of reconfiguration the filter set in the second network device in which a configuration of the filter has been changed;

reconfigure the filter of the second network device and a filter of the third network device such that a range in which a packet can be forwarded through the reconfiguring filter set in the second network device is made equal to a range in which a packet can be forwarded through the filter set in the third network device;

set the reconfigured filters into the second network device and the third network device; and

set as a filter assigned as a target of reconfiguration the filter set in the third network device, and repeat the reconfiguration for the filters.

8. The network system according to claim 7, wherein:

the plurality of network devices further include a fourth network device coupled at a lower level of the second network device; and

the management server is configured to;

identify the fourth network device by at least one of the following methods (1) and (2);

(1) with referring to the network topology, the fourth network device is identified that directly accommodates a source terminal contained in a condition of the filter assigned as a target of reconfiguration; and

(2) with referring to the network topology, the fourth network device is identified that accommodates all source terminals contained in a condition of the filter assigned as a target of reconfiguration; and

repeat the reconfiguration for the filters until the configuration of the filter of the identified fourth network device is changed.

9. The network system according to claim 7, wherein:

the management server has an interface for receiving specification of a policy, according to the type of the filter, whether the filter set in the second network device in which the configuration of the filter has been changed is to be newly specified as a filter assigned as a target of reconfiguration; and

the management server determines whether the reconfiguration for the filters is to be repeated based on the specified policy.

10. A management server provided in a network system including a plurality of network devices for forwarding a packet and a network constructed from the plurality of network devices,

the plurality of network devices include a first network device having one or more filters and a second network device coupled at a lower level of the network constructed from the plurality of network devices than the first network device such that the second network device is located closer to a terminal end of the network than the first network device along a path from an external network through the first network device

the management server being configured to:

determine a number of the one or more filters of the first network device to assign as a target of reconfiguration based on a load of a processor of the first network device for performing filter processing,

obtain topology of the network from the plurality of network devices;

reconfigure, by referring to the obtained network topology, a filter of the first network device that is assigned as a target of reconfiguration and a filter of the second network device such that a range in which packets can be forwarded through the reconfiguring filter set in the first network device is distributed to the second network device; and

set the reconfigured filters into the first network device and the second network device to configure the second network device to forward packets through the range in which packets were forwarded through the reconfiguring filter of the first network device.

11. The management server according to claim 10, wherein the management server is configured to:

identify, among network devices directly coupled to the first network device, a second network device for accommodating a source terminal included in a condition of the filter assigned as the target of reconfiguration;

specify a port of the second network device, which is coupled to the first network device, as a port in which the filter is to be set,

determine whether the range in which a packet can be forwarded through the filter set in the second network device is equal to the range in which a packet can be forwarded through the filter set in the first network device; and

reconfigure, in the case of which the ranges in which a packet can be forwarded are determined as not equal to each other, the filter of the second network device such that a permission filter whose source address is a source address contained in the condition of the filter assigned as the target of reconfiguration set in the first network device and whose destination address is a terminal accommodated in the first network device and not accommodated in the second network device is set in the specified port.

12. The management server according to claim 11, wherein:

the management server is configured to;

wherein the management server is further configured to determine the number of filters assigned as targets of reconfiguration by at least one of the following methods (1) and (2);

(1) load information of the processor of the first network device is obtained from the first network device, and then the number of filters assigned as targets of reconfiguration is determined according to the load information of the processor based on a comparison result between the obtained load information and a predetermined threshold; and

(2) the number of fitters specified through an interface provided in the management server is determined as the number of filters assigned as targets of reconfiguration; and

reconfigure the determined number of filters.

13. The management server according to claim 11, wherein the management server is configured to:

manage information concerning a type of the filter set in the first network device;

determine a priority of the filter assigned as a target of reconfiguration by at least one of the following methods (1) and (2);

(1) the type of the filter set in the first network device is judged with reference to the managed information concerning the type of the filter, and then the priority of the filter assigned as a target of reconfiguration is determined according to the judged type of the filter; and

(2) a priority for the filter specified through an interface provided in the management server is determined as the priority of the filter assigned as a target of reconfiguration; and

select, based on the determined priority, a filter to be assigned as a target of reconfiguration.

14. The management server according to claim 11, wherein:

the network topology includes physical coupling information of the network and logical coupling information of the network; and

the management server is configured to use the network topology to select a second network device coupled at a lower level of the first network device.

15. The management server according to claim 11, further comprising an interface for receiving specification of the filter assigned as a target of reconfiguration and a network device and a port before the reconfiguration of the filter, and a request of reconfiguration of the filter and setting into a real network device;

and

the management server is configured to reconfigure the filter of the network device and the port specified through the interface.

16. The management server according to claim 11, wherein:

the plurality of network devices further include a third network device coupled at a lower level of the second network device; and

the management server is configured to;

newly specify as a filter assigned as a target of reconfiguration the filter set in the second network device in which a configuration of the filter has been changed;

reconfigure the filter of the second network device and a filter of the third network device such that a range in which a packet can be forwarded through the reconfiguring filter set in the second network device is made equal to a range in which a packet can be forwarded through the filter set in the third network device;

set the reconfigured filters into the second network device and the third network device; and

set as a lifter assigned as a target of reconfiguration the filter set in the third network device, and repeat the reconfiguration for the litters.

17. The management server according to claim 16, wherein:

the plurality of network devices further include a fourth network device coupled at a lower level of the second network device; and

the management server is configured to;

identify the fourth network device by at least one of the following methods (1) and (2);

(1) with referring to the network topology, the fourth network device is identified that directly accommodates a source terminal contained in a condition of the filter assigned as a target of reconfiguration; and

(2) with referring to the network topology, the fourth network device is identified that accommodates all source terminals contained in a condition of the filter assigned as a target of reconfiguration; and

repeat the reconfiguration for the filters until the configuration of the filter of the identified fourth network device is changed.

18. The management server according to claim 16, wherein:

the management server has an interlace for receiving specification of a policy, according to the type of the filter, whether the filter set in the second network device in which the configuration of the filter has been changed is to be newly specified as a filter assigned as a target of reconfiguration; and

the management server determines whether the reconfiguration for the filters is to be repeated based on the specified policy.

19. A filter reconfiguration method executed in a network system including a plurality of network devices for forwarding a packet, a network constructed from the plurality of network devices, and a management server coupled to the network and managing the network,

the plurality of network devices include a first network device having one or more filters and a second network device coupled at a lower level of the network constructed from the plurality of network devices than the first network device such that the second network device is located closer to a terminal end of the network than the first network device along a path from an external network through the first network device,

the filter reconfiguration method comprising:

determining a number of the one or more filters of the first network device to assign as a target of reconfiguration based on a load of a processor of the first network device for performing filter processing;

acquiring topology of the network from die plurality of network devices;

reconfiguring, with referring to the obtained network topology, a filter of the first network device that is assigned as a target of reconfiguration and a filter of the second network device such that a range in which packets can be forwarded through the reconfiguring filter set in the first network device is distributed to the second network device; and

setting the reconfigured filters into the first network device and the second network device to configure the second network device to forward packets through the range in which packets were forwarded through the reconfiguring filter of the first network device.