Policy analyzer

• US 8,255,534 B2
• Filed: 06/18/2010
• Issued: 08/28/2012
• Est. Priority Date: 11/20/2003
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Assadzadeh, Alireza
• Primary Examiner(s): Duong, Oanh
• Application Number:
  US12/818,263
• Publication Number:
  US 20100257264A1
• Time in Patent Office: 802 Days
• Field of Search: 709223-225, 709/226, 709/229, 370/230.1, 370/325, 370/230, 370/235, 726/1
• US Class Current: 709/225
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Systems and methods are provided for analyzing policy rules defined for a subscriber and determining packet treatment in a network. Definitions are retrieved pertaining to policy rules for a subscriber. At least one policy point in a network is determined based on the retrieved definitions. The packet treatment is determined at each of the at least one policy point. The packet treatment is shown for each of the at least one policy point. Packets may be injected into the network at injection points and statistics may be collected. The statistics may be compared with results of analyzing policy rules for the subscriber.

Claims

1. A method, comprising:

retrieving, by a server device, definitions pertaining to a plurality of policy rules for traffic associated with a subscriber device;

based on the retrieved definitions, defining, by the server device, a plurality of policy points, in a network, for the subscriber device;

determining, by the server device, a plurality of packet treatments, each of the plurality of packet treatments being associated with one of the plurality of policy points, and the each of the plurality of packet treatments identifying one or more of the plurality of policy rules to be applied to the traffic associated with the subscriber device at the associated one of the plurality of policy points; and

outputting, by the server device, information corresponding to the plurality of packet treatments.

2. The method of claim 1, further comprising:

consolidating the plurality of packet treatments; and

distributing, through the network, information representing the consolidated plurality of packet treatments.

3. The method of claim 1, where determining the plurality of packet treatments includes:

assigning, at the one of the plurality of policy points, particular traffic associated with the subscriber device to one of a plurality of traffic groups, where the particular traffic is assigned to the one of the plurality of traffic groups based on one or more of the policy rules.

4. The method of claim 3, where assigning the traffic includes:

identifying which of the plurality of policy rules, associated with the one of the plurality of policy points, have conditions satisfied by the particular traffic; and

identifying which of the plurality of policy rules, associated with the one of the plurality of policy points, have conditions eclipsed by the particular traffic.

5. The method of claim 4, where identifying which of the plurality of policy rules, associated with the one of the plurality of policy points, have conditions eclipsed by the particular traffic is based on eclipsing rules defined for a router associated with the one of the plurality of policy points.

6. The method of claim 1,

where one of the plurality of policy points includes an interface that receives traffic in a direction, and

where determining the plurality of packet treatments includes:

obtaining a list including at least one of the plurality of policy rules, the list defined for the direction that the interface receives the traffic; and

sorting the list based on a precedence associated with each of the at least one of the plurality of policy rules.

7. The method of claim 6, further comprising:

defining permissible combined policy rules;

combining, based on the permissible combined policy rules, two or more of the at least one of the plurality of policy rules in the list; and

resorting the list.

8. A network device, comprising:

a first interface to retrieve definitions in a memory, the definitions pertaining to a plurality of policy rules;

processor to;

define, based on the retrieved definitions, a plurality of policy points in a network, and

determine a plurality of packet treatments, each of the plurality of packet treatments being associated with one of the plurality of policy points, and the each of the plurality of packet treatments identifying one or more of the plurality of policy rules being applied at the associated one of the plurality of policy points; and

a second interface to output information corresponding to the plurality of packet treatments.

9. The network device of claim 8, further comprising:

a third interface to receive management information from a management server device, where the processor, when determining the plurality of packet treatments, uses the management information.

10. The network device of claim 8, further comprising:

a third interface to exchange network information with another device on third network, where the processor, when determining the plurality of packet treatments and defining a plurality of policy points in a network, uses the network information.

11. The network device of claim 8, further comprising:

an third interface to;

send commands to an agent associated with one of the plurality of policy points, and

receive information from the agent related to the packet treatment at the associated one of the plurality of policy points.

12. The network device of claim 11, where the third interface is further to:

command the agent to inject packets into the network at the associated one of the plurality of policy points.

13. The network device of claim 12, where the third interface is further to:

receive and store statistics from the agent, the statistics being related to the packet treatment at the associated one of the plurality of policy points in response to the injected packets.

14. The network device of claim 8, where the processor is further to:

when determining the plurality of packet treatments, use policy rule definitions for a subscriber device.

15. The network device of claim 8, where the processor is further to:

analyze traffic received at one of the plurality of policy points, including determining conformance of each of a plurality of sections in the traffic to each of the plurality of policy rules associated with the one of the plurality of policy points; and

based on the analysis, assign each of the plurality of sections in the traffic to one of a plurality of traffic groups.

16. The network device of claim 15, where the processor is further to determine a policy action to be implemented for each of the plurality of traffic groups.

17. A non-transitory computer-readable medium comprising:

one or more instructions which, when executed by a processor, cause the processor to retrieve definitions pertaining to a plurality of policy rules for traffic associated with a subscriber device;

one or more instructions which, when executed by the processor, cause the processor to define, based on the retrieved definitions, a plurality of policy points in a network for the subscriber device; and

one or more instructions which, when executed by the processor, cause the processor to determine a plurality of packet treatments, each of the plurality of packet treatments being associated with one of the plurality of policy points, and the each of the plurality of packet treatments identifying one or more of the plurality of policy rules to be applied to the traffic associated with the subscriber device at the associated one of the plurality of policy points.

18. The computer-readable medium of claim 17, further comprising:

one or more instructions to consolidate the plurality of packet treatments; and

one or more instructions to distribute, through the network, information representing the consolidated plurality of packet treatments.

19. The computer-readable medium of claim 17, where the one or more instructions to determine the plurality of packet treatments include:

one or more instructions to forward instructions to assign, at the one of the plurality of policy points, particular traffic associated with the subscriber device to one of a plurality of traffic groups, where the particular traffic is assigned to the one of the plurality of traffic groups depending on a compliance of the traffic to the policy rules associated with the one of the plurality of policy points.

20. The computer-readable medium of claim 17, where the one or more instructions to determine the plurality of packet treatments include:

one or more instructions to analyze the traffic to determine at least one of the policy rules satisfied by the traffic; and

one or more instructions to consolidate the at least one of the policy rules satisfied by the traffic.