Managing network devices

• US 8,438,252 B2
• Filed: 12/22/2011
• Issued: 05/07/2013
• Est. Priority Date: 04/30/2009
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Zuk, Nir, Ithal, Ravi, Bharali, Anupam
• Primary Examiner(s): Baturay, Alicia
• Application Number:
  US13/335,745
• Publication Number:
  US 20120166599A1
• Time in Patent Office: 502 Days
• Field of Search: 709220-222
• US Class Current: 709/220
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for managing network devices. A central management system stores shared configuration objects in a central configuration database. A network device stores shared configuration objects and device-specific configuration objects in a local configuration database. The local configuration database'"'"'s shared configuration objects correspond to shared configuration objects in the central configuration database. The network device can be configured locally or using the central management system.

Claims

1. A method performed by a first network device for configuring the first network device using a central management system, the method comprising:

storing a plurality of shared configuration objects and a plurality of device-specific configuration objects in a local configuration data store for the first network device using a processor, wherein;

each shared configuration object stored in the local configuration data store corresponds to a shared configuration object stored in a central configuration data store for the central management system;

each device-specific configuration object is not stored in the central configuration data store for the central management system;

each shared configuration object and each device-specific configuration object is used by the first network device to configure the first network device, wherein the first network device performs packet processing;

receiving a first request from the central management system to update a respective value of a first shared configuration object in the local configuration data store with a first new value and updating the respective value of the first shared configuration object in the local configuration data store with the first new value; and

receiving a second request to update a respective value of a first device-specific configuration object in the local configuration data store with a second new value and updating the respective value of the first device-specific configuration object in the local configuration data store with the second new value;

receiving a third request originating from the central management system to update the respective value of a second shared configuration object that is not in the local configuration data store with a third new value, determining the relevance of the second shared configuration object, and creating a new shared configuration object in the local configuration data store corresponding to the second shared configuration object and updated with the third new value in the event that the second shared configuration object is determined to be relevant, wherein responsive to an update request from a second network device, the central management system having selected the first network device as an additional network device to receive the third new value; and

determining a configuration object to process a packet at the first network device, wherein in the event of a conflict between the plurality of shared configuration objects and the plurality of device-specific configuration objects in the local configuration data store for the first network device, resolving the conflict based at least in part on a priority list specifying a processing order.

2. The method of claim 1 wherein:

the first network device comprises a security device or a Virtual Private Network (VPN) server.

3. The method of claim 1 wherein:

the first network device comprises a security device or a Virtual Private Network (VPN) server; and

the first shared configuration object or the first device-specific configuration object comprises a security policy parameter or a VPN policy parameter.

4. The method of claim 1 wherein:

the first network device comprises a routing device.

5. The method of claim 1 wherein:

the first network device comprises a routing device;

the first shared configuration object comprises a Domain Name Service (DNS) server address; and

the first device-specific configuration object comprises a next hop router address.

6. The method of claim 1 wherein:

the first network device is configured to select a configuration object of a plurality of configuration objects in the local configuration data store based on a priority list in order to process a first packet, wherein the priority list comprises a processing order for the plurality of configuration objects.

7. The method of claim 1 further comprising:

receiving a third request not originating from the central management system to update the respective value of the first shared configuration object in the local configuration data store with a third new value; and

rejecting the third request to update the respective value of the first shared configuration object in the local configuration data store.

8. The method of claim 1, wherein the priority list assigns a higher priority to shared configuration objects.

9. The method of claim 1, wherein the priority list assigns a higher priority to device-specific configuration objects.

10. The method of claim 1, wherein the first network device determines the relevance of the second shared configuration object by comparing the second shared configuration object with a list of relevant configuration objects.

11. A computer program product, encoded on a computer-readable storage device, operable to cause a first network device to perform operations comprising:

storing a plurality of shared configuration objects and a plurality of device-specific configuration objects in a local configuration data store for the first network device using a processor, wherein;

each shared configuration object stored in the local configuration data store corresponds to a shared configuration object stored in a central configuration data store for the central management system;

each device-specific configuration object is not stored in the central configuration data store for the central management system;

each shared configuration object and each device-specific configuration object is used by the first network device to configure the first network device, wherein the first network device performs packet processing;

receiving a first request from the central management system to update a respective value of a first shared configuration object in the local configuration data store with a first new value and updating the respective value of the first shared configuration object in the local configuration data store with the first new value; and

receiving a second request to update a respective value of a first device-specific configuration object in the local configuration data store with a second new value and updating the respective value of the first device-specific configuration object in the local configuration data store with the second new value;

receiving a third request originating from the central management system to update the respective value of a second shared configuration object that is not in the local configuration data store with a third new value, determining the relevance of the second shared configuration object, and creating a new shared configuration object in the local configuration data store corresponding to the second shared configuration object and updated with the third new value in the event that the second shared configuration object is determined to be relevant, wherein responsive to an update request from a second network device, the central management system having selected the first network device as an additional network device to receive the third new value; and

determining a configuration object to process a packet at the first network device, wherein in the event of a conflict between the plurality of shared configuration objects and the plurality of device-specific configuration objects in the local configuration data store for the first network device, resolving the conflict based at least in part on a priority list specifying a processing order.

12. The computer program product of claim 11, where:

the first network device comprises a security device or a Virtual Private Network (VPN) server.

13. The computer program product of claim 11, where:

the first network device comprises a security device or a Virtual Private Network (VPN) server; and

the first shared configuration object or the first device-specific configuration object comprises a security policy parameter or a VPN policy parameter.

14. The computer program product of claim 11, where:

the first network device comprises a routing device.

15. The computer program product of claim 11, where:

the first network device comprises a routing device;

the first shared configuration object comprises a Domain Name Service (DNS) server address; and

the first device-specific configuration object comprises a next hop router address.

16. The computer program product of claim 11, where:

the first network device is configured to select a configuration object of a plurality of configuration objects in the local configuration data store based on a priority list in order to process a first packet, wherein the priority list comprises a processing order for the plurality of configuration objects.

17. The computer program product of claim 11, the operations further comprising:

receiving a third request not originating from the central management system to update the respective value of the first shared configuration object in the local configuration data store with a third new value; and

rejecting the third request to update the respective value of the first shared configuration object in the local configuration data store.

18. The computer program product of claim 11, wherein the priority list assigns a higher priority to shared configuration objects.

19. The computer program product of claim 11, wherein the priority list assigns a higher priority to device-specific configuration objects.

20. The computer program product of claim 11, wherein the first network device determines the relevance of the second shared configuration object by comparing the second shared configuration object with a list of relevant configuration objects.

21. A system comprising:

a first network device comprising one or more processors and one or more network interfaces;

wherein the first network device has encoded on a non-transitory computer-readable medium instructions operable to cause one or more of the processors of the first network device to perform operations comprising;

storing a plurality of shared configuration objects and a plurality of device-specific configuration objects in a local configuration data store for the first network device using a processor, wherein;

each shared configuration object stored in the local configuration data store corresponds to a shared configuration object stored in a central configuration data store for the central management system;

each device-specific configuration object is not stored in the central configuration data store for the central management system;

each shared configuration object and each device-specific configuration object is used by the first network device to configure the first network device, wherein the first network device performs packet processing;

receiving a first request from the central management system to update a respective value of a first shared configuration object in the local configuration data store with a first new value and updating the respective value of the first shared configuration object in the local configuration data store with the first new value; and

receiving a second request to update a respective value of a first device-specific configuration object in the local configuration data store with a second new value and updating the respective value of the first device-specific configuration object in the local configuration data store with the second new value;

receiving a third request originating from the central management system to update the respective value of a second shared configuration object that is not in the local configuration data store with a third new value, determining the relevance of the second shared configuration object, and creating a new shared configuration object in the local configuration data store corresponding to the second shared configuration object and updated with the third new value in the event that the second shared configuration object is determined to be relevant, wherein responsive to an update request from a second network device, the central management system having selected the first network device as an additional network device to receive the third new value; and

determining a configuration object to process a packet at the first network device, wherein in the event of a conflict between the plurality of shared configuration objects and the plurality of device-specific configuration objects in the local configuration data store for the first network device, resolving the conflict based at least in part on a priority list specifying a processing order.

22. The system of claim 21 wherein:

the first network device comprises a security device or a Virtual Private Network (VPN) server.

23. The system of claim 21 wherein:

the first network device comprises a security device or a Virtual Private Network (VPN) server; and

the first shared configuration object or the first device-specific configuration object comprises a security policy parameter or a VPN policy parameter.

24. The system of claim 21 wherein:

the first network device comprises a routing device.

25. The system of claim 21 wherein:

the first network device comprises a routing device;

the first shared configuration object comprises a Domain Name Service (DNS) server address; and

the first device-specific configuration object comprises a next hop router address.

26. The system of claim 21 where:

the first network device is configured to select a configuration object of a plurality of configuration objects in the local configuration data store based on a priority list in order to process a first packet, wherein the priority list comprises a processing order for the plurality of configuration objects.

27. The system of claim 21, the operations further comprising:

receiving a third request not originating from the central management system to update the respective value of the first shared configuration object in the local configuration data store with a third new value; and

rejecting the third request to update the respective value of the first shared configuration object in the local configuration data store.

28. The system of claim 21, wherein the priority list assigns a higher priority to shared configuration objects.

29. The system of claim 21, wherein the priority list assigns a higher priority to device-specific configuration objects.

30. The system of claim 21, wherein the first network device determines the relevance of the second shared configuration object by comparing the second shared configuration object with a list of relevant configuration objects.