Managing network devices

• US 8,108,495 B1
• Filed: 04/30/2009
• Issued: 01/31/2012
• Est. Priority Date: 04/30/2009
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Zuk, Nir, Bharali, Anupam, Ithal, Ravi
• Primary Examiner(s): Gillis, Brian J
• Assistant Examiner(s): Baturay, Alicia
• Application Number:
  US12/433,728
• Time in Patent Office: 1,006 Days
• Field of Search: 709220-222
• US Class Current: 709/220
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for managing network devices. A central management system stores shared configuration objects in a central configuration database. A network device stores shared configuration objects and device-specific configuration objects in a local configuration database. The local configuration database'"'"'s shared configuration objects correspond to shared configuration objects in the central configuration database. The network device can be configured locally or using the central management system.

Claims

1. A computer-implemented method performed by a central management system for configuring a plurality of network devices, the method comprising:

storing a plurality of shared configuration objects in a central configuration database for the central management system;

receiving a first request to update a respective value of a first shared configuration object in the central configuration database with a first new value and updating the respective value of the first shared configuration object in the central configuration database with the first new value;

responsive to the first request;

selecting the plurality of network devices each storing a configuration object corresponding to the first shared configuration object of the central configuration database in a local configuration database;

sending the first new value to the selected network devices where each network device updates a respective value of the network device'"'"'s configuration object corresponding to the first shared configuration object in the network device'"'"'s local configuration database with the first new value, and where the updated configuration object is used by the network device to configure how the network device processes a first plurality of packets;

receiving a second request to update a respective value of a device-specific configuration object with a second new value, where the device-specific configuration object is not stored in the central configuration database;

responsive to the second request;

selecting a first network device in the plurality of network devices, where the first network device stores the device-specific configuration object in the first network device'"'"'s local configuration database; and

sending the second new value to the first network device where the first network device updates the respective value of the device-specific configuration object in the first network device'"'"'s local configuration database with the second new value, and where the updated device-specific configuration object is used by the first device to configure how the first device processes a second plurality of packets;

determining that the first network device received a third request not originating from the central management system to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the first network device'"'"'s local configuration database; and

responsive to determining that the first network device received the third request, generating a second configuration object in the central configuration database and updating the respective value of the second configuration object with the second new value;

wherein the central management system associates the second configuration object with the first network device, and wherein the central management system disassociates the first shared configuration object with the first network device.

2. The method of claim 1 where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the first shared configuration object or the device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

3. The method of claim 1 where:

the first network device is a routing device;

the first shared configuration object specifies a Domain Name Service (DNS) server address; and

the device-specific configuration object specifies a next hop router address.

4. The method of claim 1 where:

the first network device includes a priority list specifying a processing order for a plurality of configuration objects in the first network device'"'"'s local configuration database; and

the first network device is configured to select a configuration object of the plurality of configuration objects based on the priority list in order to process a first packet.

5. The method of claim 1 where:

the first network device receives a third request not originating from the central management system to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the first network device'"'"'s local configuration database; and

the first network device rejects the third request to change the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the network device'"'"'s local configuration database.

6. The method of claim 1 further comprising:

responsive to the first request;

selecting an additional network device, where the additional network device'"'"'s local configuration database does not store a configuration object corresponding to the first shared configuration object of the central configuration database; and

sending the first new value to the additional network device.

7. A computer-implemented method performed by a first network device for configuring the first network device, the method comprising:

storing a plurality of shared configuration objects and a plurality of device-specific configuration objects in a local configuration database for the first network device, where;

each shared configuration object in the local configuration database corresponds to a shared configuration object in a central configuration database for a central management system;

each device-specific configuration object is not stored in the central configuration database for the central management system;

each shared configuration object and each device-specific configuration object is used by the first network device to configure how the first network device processes a plurality of packets;

receiving a first request from the central management system to update a respective value of a first shared configuration object in the local configuration database with a first new value and updating the respective value of the first shared configuration object in the local configuration database with the first new value; and

receiving a second request to update a respective value of a first device-specific configuration object in the local configuration database with a second new value and updating the respective value of the first device-specific configuration object in the local configuration database with the second new value;

receiving a third request not originating from the central management system to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the first network device'"'"'s local configuration database; and

responsive to receiving the third request, the central management system generating a second configuration object in the central configuration database and updating the respective value of the second configuration object with the second new value;

wherein the central management system associates the second configuration object with the first network device, and wherein the central management system disassociates the first shared configuration object with the first network device.

8. The method of claim 7 where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the first shared configuration object or the first device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

9. The method of claim 7 where:

the first network device is a routing device;

the first shared configuration object specifies a Domain Name Service (DNS) server address; and

the first device-specific configuration object specifies a next hop router address.

10. The method of claim 7 where:

the first network device is configured to select a configuration object of a plurality of configuration objects in the local configuration database based on a priority list in order to process a first packet, where the priority list specifies a processing order for the plurality of configuration objects.

11. The method of claim 7 further comprising:

receiving a third request not originating from the central management system to update the respective value of the first shared configuration object in the local configuration database with a third new value; and

rejecting the third request to update the respective value of the first shared configuration object in the local configuration database.

12. A computer program product, encoded on a computer-readable storage device, operable to cause a central management system to perform operations for configuring a plurality of network devices, the operations comprising:

storing a plurality of shared configuration objects in a central configuration database for the central management system;

receiving a first request to update a respective value of a first shared configuration object in the central configuration database with a first new value and updating the respective value of the first shared configuration object in the central configuration database with the first new value;

responsive to the first request;

selecting the plurality of network devices each storing a configuration object corresponding to the first shared configuration object of the central configuration database in a local configuration database;

sending the first new value to the selected network devices where each network device updates a respective value of the network device'"'"'s configuration object corresponding to the first shared configuration object in the network device'"'"'s local configuration database with the first new value, and where the updated configuration object is used by the network device to configure how the network device processes a first plurality of packets;

receiving a second request to update a respective value of a device-specific configuration object with a second new value, where the device-specific configuration object is not stored in the central configuration database;

responsive to the second request;

selecting a first network device in the plurality of network devices, where the first network device stores the device-specific configuration object in the first network device'"'"'s local configuration database; and

sending the second new value to the first network device where the first network device updates the respective value of the device-specific configuration object in the first network device'"'"'s local configuration database with the second new value, and where the updated device-specific configuration object is used by the first device to configure how the first device processes a second plurality of packets;

determining that the first network device received a third request not originating from the central management system to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the first network device'"'"'s local configuration database; and

responsive to determining that the first network device received the third request, generating a second configuration object in the central configuration database and updating the respective value of the second configuration object with the second new value;

wherein the central management system associates the second configuration object with the first network device, and wherein the central management system disassociates the first shared configuration object with the first network device.

13. The computer program product of claim 12, where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the first shared configuration object or the device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

14. The computer program product of claim 12, where:

the first network device is a routing device;

the first shared configuration object specifies a Domain Name Service (DNS) server address; and

the device-specific configuration object specifies a next hop router address.

15. The computer program product of claim 12, where:

the first network device includes a priority list specifying a processing order for a plurality of configuration objects in the first network device'"'"'s local configuration database; and

the first network device is configured to select a configuration object of the plurality of configuration objects based on the priority list in order to process a first packet.

16. The computer program product of claim 12, where:

the first network device receives a third request not originating from the central management system to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the first network device'"'"'s local configuration database; and

the first network device rejects the third request to change the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the network device'"'"'s local configuration database.

17. The computer program product of claim 12, the operations further comprising:

responsive to the first request;

selecting an additional network device, where the additional network device'"'"'s local configuration database does not store a configuration object corresponding to the first shared configuration object of the central configuration database; and

sending the first new value to the additional network device.

18. A computer program product, encoded on a computer-readable storage device, operable to cause a first network device to perform operations comprising:

storing a plurality of shared configuration objects and a plurality of device-specific configuration objects in a local configuration database for the first network device, where;

each shared configuration object in the local configuration database corresponds to a shared configuration object in a central configuration database for a central management system;

each device-specific configuration object is not stored in the central configuration database for the central management system;

each shared configuration object and each device-specific configuration object is used by the first network device to configure how the first network device processes a plurality of packets;

receiving a first request from the central management system to update a respective value of a first shared configuration object in the local configuration database with a first new value and updating the respective value of the first shared configuration object in the local configuration database with the first new value; and

receiving a second request to update a respective value of a first device-specific configuration object in the local configuration database with a second new value and updating the respective value of the first device-specific configuration object in the local configuration database with the second new value;

receiving a third request not originating from the central management system to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the first network device'"'"'s local configuration database; and

responsive to receiving the third request, the central management system generating a second configuration object in the central configuration database and updating the respective value of the second configuration object with the second new value;

wherein the central management system associates the second configuration object with the first network device, and wherein the central management system disassociates the first shared configuration object with the first network device.

19. The computer program product of claim 18, where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the first shared configuration object or the first device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

20. The computer program product of claim 18, where:

the first network device is a routing device;

the first shared configuration object specifies a Domain Name Service (DNS) server address; and

the first device-specific configuration object specifies a next hop router address.

21. The computer program product of claim 18, where:

the first network device is configured to select a configuration object of a plurality of configuration objects in the local configuration database based on a priority list in order to process a first packet, where the priority list specifies a processing order for the plurality of configuration objects.

22. The computer program product of claim 18, the operations further comprising:

receiving a third request not originating from the central management system to update the respective value of the first shared configuration object in the local configuration database with a third new value; and

rejecting the third request to update the respective value of the first shared configuration object in the local configuration database.

23. A system comprising:

a central management system comprising one or more processors and one or more network interfaces;

where the central management system has encoded on a non-transitory computer-readable medium instructions operable to cause one or more of the processors of the central management system to perform operations comprising;

storing a plurality of shared configuration objects in a central configuration database for the central management system;

receiving using one of the network interfaces a first request to update a respective value of a first shared configuration object in the central configuration database with a first new value and updating the respective value of the first shared configuration object in the central configuration database with the first new value;

responsive to the first request;

selecting the plurality of network devices each storing a configuration object corresponding to the first shared configuration object of the central configuration database in a local configuration database;

sending the first new value to the selected network devices where each network device updates a respective value of the network device'"'"'s configuration object corresponding to the first shared configuration object in the network device'"'"'s local configuration database with the first new value, and where the updated configuration object is used by the network device to configure how the network device processes a first plurality of packets;

receiving a second request to update a respective value of a device-specific configuration object with a second new value, where the device-specific configuration object is not stored in the central configuration database;

responsive to the second request;

selecting a first network device in the plurality of network devices, where the first network device stores the device-specific configuration object in the first network device'"'"'s local configuration database; and

sending the second new value to the first network device where the first network device updates the respective value of the device-specific configuration object in the first network device'"'"'s local configuration database with the second new value, and where the updated device-specific configuration object is used by the first device to configure how the first device processes a second plurality of packets;

determining that the first network device received a third request not originating from the central management system to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the first network device'"'"'s local configuration database; and

responsive to determining that the first network device received the third request, generating a second configuration object in the central configuration database and updating the respective value of the second configuration object with the second new value;

wherein the central management system associates the second configuration object with the first network device, and wherein the central management system disassociates the first shared configuration object with the first network device.

24. The system of claim 23 where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the first shared configuration object or the device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

25. The system of claim 23 where:

the first network device is a routing device;

the first shared configuration object specifies a Domain Name Service (DNS) server address; and

the device-specific configuration object specifies a next hop router address.

26. The system of claim 23 where:

the first network device includes a priority list specifying a processing order for a plurality of configuration objects in the first network device'"'"'s local configuration database; and

the first network device is configured to select a configuration object of the plurality of configuration objects based on the priority list in order to process a first packet.

27. The system of claim 23 where:

the first network device receives a third request not originating from the central management system to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the first network device'"'"'s local configuration database; and

the first network device rejects the third request to change the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the network device'"'"'s local configuration database.

28. The system of claim 23, the operations further comprising:

responsive to the first request;

selecting an additional network device, where the additional network device'"'"'s local configuration database does not store a configuration object corresponding to the first shared configuration object of the central configuration database; and

sending the first new value to the additional network device.

29. A system comprising:

a first network device comprising one or more processors and one or more network interfaces;

where the first network device has encoded on a non-transitory computer-readable medium instructions operable to cause one or more of the processors of the first network device to perform operations comprising;

storing a plurality of shared configuration objects and a plurality of device-specific configuration objects in a local configuration database for the first network device, where;

each shared configuration object in the local configuration database corresponds to a shared configuration object in a central configuration database for a central management system;

each device-specific configuration object is not stored in the central configuration database for the central management system;

each shared configuration object and each device-specific configuration object is used by the first network device to configure how the first network device processes a plurality of packets;

receiving using one of the network interfaces a first request from the central management system to update a respective value of a first shared configuration object in the local configuration database with a first new value and updating the respective value of the first shared configuration object in the local configuration database with the first new value; and

receiving a second request to update a respective value of a first device-specific configuration object in the local configuration database with a second new value and updating the respective value of the first device-specific configuration object in the local configuration database with the second new value;

receiving a third request not originating from the central management system to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object in the first network device'"'"'s local configuration database; and

responsive to receiving the third request, the central management system generating a second configuration object in the central configuration database and updating the respective value of the second configuration object with the second new value;

wherein the central management system associates the second configuration object with the first network device, and wherein the central management system disassociates the first shared configuration object with the first network device.

30. The system of claim 29 where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the first shared configuration object or the first device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

31. The system of claim 29 where:

the first network device is a routing device;

the first shared configuration object specifies a Domain Name Service (DNS) server address; and

the first device-specific configuration object specifies a next hop router address.

32. The system of claim 29 where:

the first network device is configured to select a configuration object of a plurality of configuration objects in the local configuration database based on a priority list in order to process a first packet, where the priority list specifies a processing order for the plurality of configuration objects.

33. The system of claim 29, the operations further comprising:

receiving a third request not originating from the central management system to update the respective value of the first shared configuration object in the local configuration database with a third new value; and

rejecting the third request to update the respective value of the first shared configuration object in the local configuration database.