Managing network devices

• US 8,284,699 B1
• Filed: 04/30/2009
• Issued: 10/09/2012
• Est. Priority Date: 04/30/2009
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Zuk, Nir
• Primary Examiner(s): Rinehart, Mark
• Assistant Examiner(s): ANWAR, MOHAMMAD S
• Application Number:
  US12/433,740
• Time in Patent Office: 1,258 Days
• Field of Search: 370/254, 370/230, 370/230.1
• US Class Current: 370/254
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/084 Configuration by using pre-existing information, e.g. using templates or copying from other elements
• CPC Class Codes: H04L 41/085 Retrieval of network configuration; Tracking network configuration history

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for configuring network devices. A central management system stores shared configuration objects in a central configuration database. A network device stores shared configuration objects and device-specific configuration objects in a local configuration database. The local configuration database'"'"'s shared configuration objects correspond to shared configuration objects in the central configuration database. The central management system determines the network device has received a request to update a shared configuration object, where the request did not originate from the central management system, and updates the central configuration database.

Claims

1. A computer-implemented method performed by a central management system for configuring a plurality of network devices, the method comprising:

storing a plurality of shared configuration objects in a central configuration database for the central management system, where each shared configuration object is associated with at least one network device;

receiving a first request to update a respective value of a first shared configuration object in the central configuration database with a first new value and updating the respective value of the first shared configuration object in the central configuration database with the first new value;

responsive to the first request;

selecting the plurality of network devices, each storing a configuration object corresponding to the first shared configuration object of the central configuration database in a local configuration database, and each being associated with the first shared configuration object, where the updated configuration object is used by the network device to configure how the network device processes a plurality of packets;

sending the first new value to the selected plurality of network devices where each network device updates a respective value of the network device'"'"'s configuration object corresponding to the first shared configuration object in the network device'"'"'s local configuration database with the first new value;

determining that a first network device of the plurality of network devices has received a second request to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object with a second new value, where the second request is determined to not have originated from the central management system, wherein in response to the second request the first network device is configured to update the respective value of the first network device'"'"'s configuration object in the first network device'"'"'s local configuration database with the second new value;

responsive to determining that the first network device received the second request performing synchronization between the first network device and the central management system including by;

creating a second configuration object in the central configuration database, wherein the second configuration object comprises a new configuration object;

updating the respective value of the second configuration object with the second new value;

associating the second configuration object with the first network device; and

disassociating the first shared configuration object with the first network device.

2. The method of claim 1 where:

determining that the first network device received the second request includes receiving from the first network device a notification that the first network device received the second request, where the first network device sends the notification in response to receiving the second request.

3. The method of claim 1 where:

determining that the first network device received the second request includes periodically polling the plurality of network devices to determine whether one of the plurality of network devices has received any request not originating from the central management system.

4. The method of claim 1 where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the shared configuration object or the device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

5. The method of claim 1 where:

the first network device includes a priority list specifying a processing order for a plurality of configuration objects in the first network device'"'"'s local configuration database; and

the first network device is configured to select a configuration object of the plurality of configuration objects based on the priority list in order to process a first packet.

6. The method of claim 1 further comprising:

responsive to the first request;

selecting an additional network device, where the additional network device'"'"'s local configuration database does not store a configuration object corresponding to the first shared configuration object of the central configuration database; and

sending the first new value to the additional network device.

7. The method of claim 1, further comprising:

responsive to the first request;

sending the first new value to an additional network device, where the additional network device'"'"'s local configuration database does not store a configuration object corresponding to the first shared configuration object of the central configuration database; and

where the additional network device, responsive to receiving the first new value, is configured to perform one or more of the following;

send an error message to the central management system and create a new configuration object in the additional network device'"'"'s local configuration database corresponding to the first shared configuration object of the central configuration database.

8. A computer-implemented method performed by a first network device for configuring the first network device, the method comprising:

storing a plurality of configuration objects in a local configuration database, where;

the plurality of configuration objects includes a first plurality of shared configuration objects, where each shared configuration object corresponds to a shared configuration object in a central configuration database for a central management system, and where each shared configuration object in the central configuration database is associated with at least one network device;

each configuration object is used by the first network device to configure how the first network device processes a plurality of packets;

receiving a first request from the central management system to update a respective value of a first shared configuration object of the first plurality of shared configuration objects with a first new value, where the shared configuration object in the central configuration database corresponding to the first shared configuration object is associated with the first network device and a plurality of network devices;

updating the respective value of the first shared configuration object in the local configuration database with the first new value;

receiving a second request to update the respective value of the first shared configuration object in the local configuration database with a second new value, where the second request does not originate from the central management system;

updating the respective value of the first shared configuration object in the local configuration database with the second new value;

sending a notification to the central management system that the first network device received the second request, where the central management system, responsive to the notification, performs synchronization between the first network device and the central management system including by;

creating a second configuration object in the central configuration database, wherein the second configuration object comprises a new configuration object;

updating the respective value of the second configuration object with the second new value;

associating the second configuration object with the first network device; and

disassociating the first shared configuration object with the first network device.

9. The method of claim 8 where:

sending the notification is responsive to receiving the second request.

10. The method of claim 8 where:

sending the notification is responsive to a third request from the central management system, where the third request is a polling request sent periodically by the central management system.

11. The method of claim 8 where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the shared configuration object or the device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

12. The method of claim 8 where:

the first network device is configured to select a configuration object of a plurality of configuration objects in the local configuration database based on a priority list in order to process a first packet, where the priority list specifies a processing order for the plurality of configuration objects.

13. A computer program product, encoded on a non-transitory computer-readable medium, operable to cause a central management system to perform operations for configuring a plurality of network devices, the operations comprising:

storing a plurality of shared configuration objects in a central configuration database for the central management system, where each shared configuration object is associated with at least one network device;

receiving a first request to update a respective value of a first shared configuration object in the central configuration database with a first new value and updating the respective value of the first shared configuration object in the central configuration database with the first new value;

responsive to the first request;

selecting the plurality of network devices, each storing a configuration object corresponding to the first shared configuration object of the central configuration database in a local configuration database, and each being associated with the first shared configuration object, where the updated configuration object is used by the network device to configure how the network device processes a plurality of packets;

sending the first new value to the selected plurality of network devices where each network device updates a respective value of the network device'"'"'s configuration object corresponding to the first shared configuration object in the network device'"'"'s local configuration database with the first new value;

determining that a first network device of the plurality of network devices has received a second request to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object with a second new value, where the second request is determined to not have originated from the central management system, wherein in response to the second request the first network device is configured to update the respective value of the first network device'"'"'s configuration object in the first network device'"'"'s local configuration database with the second new value;

responsive to determining that the first network device received the second request performing synchronization between the first network device and the central management system including by;

creating a second configuration object in the central configuration database, wherein the second configuration object comprises a new configuration object;

updating the respective value of the second configuration object with the second new value;

associating the second configuration object with the first network device; and

disassociating the first shared configuration object with the first network device.

14. The computer program product of claim 13, further comprising:

responsive to the first request;

sending the first new value to an additional network device, where the additional network device'"'"'s local configuration database does not store a configuration object corresponding to the first shared configuration object of the central configuration database; and

where the additional network device, responsive to receiving the first new value, is configured to perform one or more of the following;

send an error message to the central management system and create a new configuration object in the additional network device'"'"'s local configuration database corresponding to the first shared configuration object of the central configuration database.

15. The computer program product of claim 13, where:

determining that the first network device received the second request includes receiving from the first network device a notification that the first network device received the second request, where the first network device sends the notification in response to receiving the second request.

16. The computer program product of claim 13, where:

determining that the first network device received the second request includes periodically polling the plurality of network devices to determine whether one of the plurality of network devices has received any request not originating from the central management system.

17. The computer program product of claim 13, where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the shared configuration object or the device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

18. The computer program product of claim 13, where:

the first network device includes a priority list specifying a processing order for a plurality of configuration objects in the first network device'"'"'s local configuration database; and

the first network device is configured to select a configuration object of the plurality of configuration objects based on the priority list in order to process a first packet.

19. The computer program product of claim 13, the operations further comprising:

responsive to the first request;

selecting an additional network device, where the additional network device'"'"'s local configuration database does not store a configuration object corresponding to the first shared configuration object of the central configuration database; and

sending the first new value to the additional network device.

20. A computer program product, encoded on a non-transitory computer-readable medium, operable to cause a first network device to perform operations comprising:

storing a plurality of configuration objects in a local configuration database, where;

the plurality of configuration objects includes a first plurality of shared configuration objects, where each shared configuration object corresponds to a shared configuration object in a central configuration database for a central management system, and where each shared configuration object in the central configuration database is associated with at least one network device;

each configuration object is used by the first network device to configure how the first network device processes a plurality of packets;

receiving a first request from the central management system to update a respective value of a first shared configuration object of the first plurality of shared configuration objects with a first new value, where the shared configuration object in the central configuration database corresponding to the first shared configuration object is associated with the first network device and a plurality of network devices;

updating the respective value of the first shared configuration object in the local configuration database with the first new value;

receiving a second request to update the respective value of the first shared configuration object in the local configuration database with a second new value, where the second request does not originate from the central management system;

updating the respective value of the first shared configuration object in the local configuration database with the second new value;

sending a notification to the central management system that the first network device received the second request, where the central management system, responsive to the notification, performs synchronization between the first network device and the central management system including by;

creating a second configuration object in the central configuration database, wherein the second configuration object comprises a new configuration object;

updating the respective value of the second configuration object with the second new value;

associating the second configuration object with the first network device; and

disassociating the first shared configuration object with the first network device.

21. The computer program product of claim 20, where:

sending the notification is responsive to receiving the second request.

22. The computer program product of claim 20, where:

sending the notification is responsive to a third request from the central management system, where the third request is a polling request sent periodically by the central management system.

23. The computer program product of claim 20, where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the shared configuration object or the device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

24. The computer program product of claim 20, where:

the first network device is configured to select a configuration object of a plurality of configuration objects in the local configuration database based on a priority list in order to process a first packet, where the priority list specifies a processing order for the plurality of configuration objects.

25. A system comprising:

a central management system comprising one or more processors and one or more network interfaces;

where the central management system has encoded on a computer-readable medium instructions operable to cause one or more of the processors of the central management system to perform operations comprising;

storing a plurality of shared configuration objects in a central configuration database for the central management system, where each shared configuration object is associated with at least one network device;

receiving using one of the network interfaces a first request to update a respective value of a first shared configuration object in the central configuration database with a first new value and updating the respective value of the first shared configuration object in the central configuration database with the first new value;

responsive to the first request;

selecting the plurality of network devices, each storing a configuration object corresponding to the first shared configuration object of the central configuration database in a local configuration database, and each being associated with the first shared configuration object, where the updated configuration object is used by the network device to configure how the network device processes a plurality of packets;

sending the first new value to the selected plurality of network devices where each network device updates a respective value of the network device'"'"'s configuration object corresponding to the first shared configuration object in the network device'"'"'s local configuration database with the first new value;

determining that a first network device of the plurality of network devices has received a second request to update the respective value of the first network device'"'"'s configuration object corresponding to the first shared configuration object with a second new value, where the second request is determined to not have originated from the central management system, wherein in response to the second request the first network device is configured to update the respective value of the first network device'"'"'s configuration object in the first network device'"'"'s local configuration database with the second new value;

responsive to determining that the first network device received the second request, performing synchronization between the first network device and the central management system including by;

creating a second configuration object in the central configuration database, wherein the second configuration object comprises a new configuration object;

updating the respective value of the second configuration object with the second new value;

associating the second configuration object with the first network device; and

disassociating the first shared configuration object with the first network device.

26. The system of claim 25, where:

determining that the first network device received the second request includes receiving from the first network device a notification that the first network device received the second request, where the first network device sends the notification in response to receiving the second request.

27. The system of claim 25, where:

determining that the first network device received the second request includes periodically polling the plurality of network devices to determine whether one of the plurality of network devices has received any request not originating from the central management system.

28. The system of claim 25, where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the shared configuration object or the device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

29. The system of claim 25, where:

the first network device includes a priority list specifying a processing order for a plurality of configuration objects in the first network device'"'"'s local configuration database; and

the first network device is configured to select a configuration object of the plurality of configuration objects based on the priority list in order to process a first packet.

30. The system of claim 25, the operations further comprising:

responsive to the first request;

selecting an additional network device, where the additional network device'"'"'s local configuration database does not store a configuration object corresponding to the first shared configuration object of the central configuration database; and

sending the first new value to the additional network device.

31. The system of claim 25, further comprising:

responsive to the first request;

sending the first new value to an additional network device, where the additional network device'"'"'s local configuration database does not store a configuration object corresponding to the first shared configuration object of the central configuration database; and

where the additional network device, responsive to receiving the first new value, is configured to perform one or more of the following;

send an error message to the central management system and create a new configuration object in the additional network device'"'"'s local configuration database corresponding to the first shared configuration object of the central configuration database.

32. A system comprising:

a first network device comprising one or more processors and one or more network interfaces;

where the first network device has encoded on a computer-readable medium instructions operable to cause one or more of the processors of the first network device to perform operations comprising;

storing a plurality of configuration objects in a local configuration database, where;

the plurality of configuration objects includes a first plurality of shared configuration objects, where each shared configuration object corresponds to a shared configuration object in a central configuration database for a central management system, and where each shared configuration object in the central configuration database is associated with at least one network device;

each configuration object is used by the first network device to configure how the first network device processes a plurality of packets;

receiving using one of the network interfaces a first request from the central management system to update a respective value of a first shared configuration object of the first plurality of shared configuration objects with a first new value, where the shared configuration object in the central configuration database corresponding to the first shared configuration object is associated with the first network device and a plurality of network devices;

updating the respective value of the first shared configuration object in the local configuration database with the first new value;

receiving a second request to update the respective value of the first shared configuration object in the local configuration database with a second new value, where the second request does not originate from the central management system;

updating the respective value of the first shared configuration object in the local configuration database with the second new value;

sending a notification to the central management system that the first network device received the second request, where the central management system, responsive to the notification, performs synchronization between the first network device and the central management system including by;

creating a second configuration object in the central configuration database, wherein the second configuration object comprises a new configuration object;

updating the respective value of the second configuration object with the second new value;

associating the second configuration object with the first network device; and

disassociating the first shared configuration object with the first network device.

33. The system of claim 32, where:

sending the notification is responsive to receiving the second request.

34. The system of claim 32, where:

sending the notification is responsive to a third request from the central management system, where the third request is a polling request sent periodically by the central management system.

35. The system of claim 32, where:

the first network device is a security device or a Virtual Private Network (VPN) server; and

the shared configuration object or the device-specific configuration object specifies a security policy parameter or a VPN policy parameter.

36. The system of claim 32, where:

the first network device is configured to select a configuration object of a plurality of configuration objects in the local configuration database based on a priority list in order to process a first packet, where the priority list specifies a processing order for the plurality of configuration objects.