Automatic application of implementation-specific configuration policies

• US 8,166,140 B1
• Filed: 07/21/2009
• Issued: 04/24/2012
• Est. Priority Date: 04/14/2004
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Enns, Robert P., Schafer, Philip A.
• Primary Examiner(s): Follansbee, John
• Assistant Examiner(s): Madamba, Glenford
• Application Number:
  US12/506,833
• Time in Patent Office: 1,008 Days
• Field of Search: 709/220, 709/221
• US Class Current: 709/221
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/0866 Checking the configuration
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management

Abstract

Techniques are described for application of implementation-specific configuration policies within a network device. For example, a device, such as a router, may comprise memory to store operational configuration data and candidate configuration data. The device further includes a control unit to apply changes to the candidate configuration data based on input from a client, and apply an implementation-specific configuration policy to a copy of the changed candidate configuration data. Based on a result of applying the implementation-specific configuration policy, the device selectively commits the changes made to the candidate configuration to the operational configuration. In the event an error occurs while applying the implementation-specific configuration policy, the device does not commit the changes to the operational configuration. In this manner, the device does not allow changes that violate the implementation-specific configuration policy to be committed to the operational configuration, thereby detecting misconfiguration that may otherwise be syntactically and semantically correct.

Claims

1. A method comprising:

creating a temporary copy of operational configuration data of a network device in response to receiving a configure command from a client;

applying changes to the copy of the configuration data in response to commands from the client to form candidate configuration data for the network device;

receiving a commit command from the client;

in response to the commit command, selecting an implementation-specific configuration policy from a plurality of implementation-specific configuration policies based on an authorization level associated with the client wherein the implementation-specific configuration policy comprises a set of rules representing the specific operational requirements of the particular networks within which the network device operates; and

applying the implementation-specific configuration policy to validate the changed candidate configuration data,

committing the changes to the candidate configuration data from the temporary copy to the operational configuration data for the network device based on a result of the validation.

2. The method of claim 1, wherein applying the implementation-specific configuration policy comprises:

identifying an error within the changed candidate configuration data based on the implementation-specific configuration policy; and

correcting the error by automatically altering the changed candidate configuration data in response to the identified error.

3. The method of claim 1, wherein applying the implementation-specific configuration policy comprises:

identifying a warning condition within the changed candidate configuration data based on the implementation-specific configuration policy; and

correcting the warning condition by automatically altering the changed candidate configuration data.

4. The method of claim 1, wherein applying the implementation-specific configuration policy comprises:

receiving a commit command; and

automatically applying the implementation-specific configuration policy in response to receiving the commit command.

5. The method of claim 1, wherein selectively committing the changes includes committing the changes to the operational configuration when application of the implementation-specific configuration policy results in generation of a warning.

6. The method of claim 1, wherein selectively committing the changes includes automatically rejecting the changes when application of the implementation-specific configuration policy results in an error.

7. The method of claim 1, wherein applying an implementation-specific configuration policy comprises:

generating a copy of the candidate configuration data; and

applying the implementation-specific configuration policy to the copy of the candidate configuration.

8. The method of claim 7, wherein applying an implementation-specific configuration policy to the copy of the candidate configuration occurs via a Extensible Markup Language (XML) Application Program Interface (API).

9. The method of claim 7,

wherein generating a copy of the candidate configuration data comprises generating a version of the candidate configuration data that conforms to an Extensible Markup Language, and

wherein applying an implementation-specific configuration policy comprises applying an Extensible Style Language Transformation (XSLT) script to the copy of the candidate configuration data.

10. The method of claim 1, wherein the implementation-specific configuration policy comprises an Extensible Style Language Transformation (XSLT) script.

11. The method of claim 1, wherein the implementation-specific configuration policy is user-definable by a client, the method further comprising:

receiving input from the client; and

updating the implementation-specific configuration policy based on the input.

12. A system comprising:

a first database to store operational configuration data;

a second database to store candidate configuration data, wherein the second database is a temporary copy of at least a portion of the first database created in response to a configure command from a client; and

a control unit to apply an implementation-specific configuration policy in response to a commit command from the client to validate changes to the candidate configuration data, and copy the changed candidate configuration data from the second database to the operational configuration data of the first database based on a result of the validation,

wherein the implementation-specific configuration policy comprises a set of rules representing the specific operational requirements of the particular networks within which the network device operates, and

wherein the control unit selects the implementation-specific configuration policy based on an authorization level for the client.

13. The system of claim 12, wherein the control unit applies an implementation-specific configuration policy by generating an error based on the implementation-specific configuration policy, and selectively correcting the error by altering the changed candidate configuration data based on the error.

14. The system of claim 12, wherein the control unit applies an implementation-specific configuration policy by identifying a warning condition based on the implementation-specific configuration policy, and altering the changed candidate configuration data based on the warning condition.

15. The system of claim 12, wherein the control unit automatically rejects the changes when application of the implementation-specific configuration policy results in an error.

16. The system of claim 12, wherein the control unit comprises a management module having an Extensible Markup Language (XML) Application Program Interface (API) to apply the implementation-specific configuration policy to the copy of the candidate configuration.

17. The system of claim 16,

wherein the management interface comprises an Extensible Markup Language (XML) generator to generate the copy of the candidate configuration data, wherein the copy of the candidate configuration data includes a version of the candidate configuration data that conforms to the Extensible Markup Language, and

wherein the management interface applies an implementation-specific configuration policy comprising an Extensible Style Language Transformation (XSLT) script to the copy of the candidate configuration data.