Managing network devices

• US 9,491,047 B2
• Filed: 02/05/2013
• Issued: 11/08/2016
• Est. Priority Date: 04/30/2009
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Zuk, Nir, Ithal, Ravi, Bharali, Anupam
• Primary Examiner(s): Baturay, Alicia
• Application Number:
  US13/759,896
• Publication Number:
  US 20130198348A1
• Time in Patent Office: 1,372 Days
• Field of Search: 709/220
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for managing network devices. A central management system stores shared configuration objects in a central configuration database. A network device stores shared configuration objects and device-specific configuration objects in a local configuration database. The local configuration database'"'"'s shared configuration objects correspond to shared configuration objects in the central configuration database. The network device can be configured locally or using the central management system.

Claims

1. A method performed by a first network device for configuring the first network device using a central management system, the method comprising:

receiving a first request originating from the central management system to update a respective value of a first configuration object corresponding to a shared configuration object that is stored at a central configuration database associated with the central management system with a first new value, wherein a second configuration object corresponding to the shared configuration object is stored at a second local configuration database associated with a second network device, wherein the second network device is configured to receive the first request originating from the central management system and update the second configuration object corresponding to the shared configuration object that is stored at the second local configuration database associated with the second network device with the first new value;

determining that the first configuration object corresponding to the shared configuration object is not stored in a first local configuration data store associated with the first network device;

determining whether the shared configuration object is relevant for the first network device, in the event that the shared configuration object is determined to be relevant, creating the first configuration object corresponding to the shared configuration object in the first local configuration data store associated with the first network device and updating the first configuration object with the first new value, wherein determining whether the shared configuration object is relevant for the first network device is based at least in part on comparing the shared configuration object with a list of relevant configuration objects;

receiving a second request to update the value of the first configuration object corresponding to the shared configuration object in the first local configuration data store associated with the first network device with a second new value;

determining whether the second request originated from the central management system; and

in the event that the second request did not originate from the central management system, rejecting the second request to update the value of the first configuration object.

2. The method of claim 1, wherein in the event that the shared configuration object is determined to be irrelevant for the first network device, storing the first new value in the first local configuration data store associated with the first network device.

3. The method of claim 1, wherein in the event that the shared configuration object is determined to be irrelevant for the first network device, sending an error message associated with the first request to the central management system.

4. The method of claim 1, wherein in the event that the shared configuration object is determined to be irrelevant for the first network device, discarding the first new value.

5. The method of claim 1, wherein:

the first network device comprises a routing device; and

the shared configuration object comprises a Domain Name Service (DNS) server address.

6. The method of claim 1, wherein the first network device is selected by the central management system to which to send the first request based at least in part on the first configuration object corresponding to the shared configuration object not being stored in the first local configuration data store.

7. The method of claim 1, wherein the first network device comprises a security device or a Virtual Private Network (VPN) server.

8. The method of claim 1, wherein the first network device is configured to select a stored configuration object from a plurality of configuration objects stored in the first local configuration data store based on a priority list in order to process a first packet, wherein the priority list comprises a processing order for the plurality of configuration objects.

9. The method of claim 1, wherein in the event that the second request originated from the central management system, updating the value of the configuration object in the first local configuration data store with the second new value.

10. A system, comprising:

a first network device comprising one or more processors and one or more network interfaces;

wherein the first network device has encoded on a non-transitory computer-readable medium instructions operable to cause one or more of the processors of the first network device to perform operations comprising;

receiving a first request originating from a central management system to update a respective value of a first configuration object corresponding to a shared configuration object that is stored at a central configuration database associated with the central management system with a first new value, wherein a second configuration object corresponding to the shared configuration object is stored at a second local configuration database associated with a second network device, wherein the second network device is configured to receive the first request originating from the central management system and update the second configuration object corresponding to the shared configuration object that is stored at the second local configuration database associated with the second network device with the first new value;

determining that the first configuration object corresponding to the shared configuration object is not stored in a first local configuration data store associated with the first network device;

determining whether the shared configuration object is relevant for the first network device, in the event that the shared configuration object is determined to be relevant, creating the first configuration object corresponding to the shared configuration object in the first local configuration data store associated with the first network device and updating the first configuration object with the first new value, wherein determining whether the shared configuration object is relevant for the first network device is based at least in part on comparing the shared configuration object with a list of relevant configuration objects;

receiving a second request to update the value of the first configuration object corresponding to the shared configuration object in the first local configuration data store associated with the first network device with a second new value;

determining whether the second request originated from the central management system; and

in the event that the second request did not originate from the central management system, rejecting the second request to update the value of the first configuration object.

11. The system of claim 10, wherein in the event that the shared configuration object is determined to be irrelevant for the first network device, storing the first new value in the first local configuration data store associated with the first network device.

12. The system of claim 10, wherein in the event that the shared configuration object is determined to be irrelevant for the first network device, sending an error message associated with the first request to the central management system.

13. The system of claim 10, wherein in the event that the shared configuration object is determined to be irrelevant for the first network device, discarding the first new value.

14. The system of claim 10, wherein:

the first network device comprises a routing device; and

the shared configuration object comprises a Domain Name Service (DNS) server address.

15. The system of claim 10, wherein the first network device is selected by the central management system to which to send the first request based at least in part on the first configuration object corresponding to the shared configuration object not being stored in the first local configuration data store.

16. The system of claim 10, wherein the first network device comprises a security device or a Virtual Private Network (VPN) server.

17. The system of claim 10, wherein the first network device is configured to select a stored configuration object from a plurality of configuration objects stored in the first local configuration data store based on a priority list in order to process a first packet, wherein the priority list comprises a processing order for the plurality of configuration objects.

18. A computer program product, encoded on a non-transitory computer-readable storage device, operable to cause a first network device to perform operations comprising:

receiving a first request originating from a central management system to update a respective value of a first configuration object corresponding to a shared configuration object that is stored at a central configuration database associated with the central management system with a first new value, wherein a second configuration object corresponding to the shared configuration object is stored at a second local configuration database associated with a second network device, wherein the second network device is configured to receive the first request originating from the central management system and update the second configuration object corresponding to the shared configuration object that is stored at the second local configuration database associated with the second network device with the first new value;

determining that the first configuration object corresponding to the shared configuration object is not stored in a first local configuration data store associated with the first network device;

determining whether the shared configuration object is relevant for the first network device, in the event that the shared configuration object is determined to be relevant, creating the configuration object corresponding to the shared configuration object in the first local configuration data store associated with the first network device and updating the first configuration object with the first new value, wherein determining whether the shared configuration object is relevant for the first network device is based at least in part on comparing the shared configuration object with a list of relevant configuration objects;

receiving a second request to update the value of the first configuration object corresponding to the shared configuration object in the first local configuration data store associated with the first network device with a second new value;

determining whether the second request originated from the central management system; and

in the event that the second request did not originate from the central management system, rejecting the second request to update the value of the first configuration object.

19. The computer program product of claim 18, wherein in the event that the shared configuration object is determined to be irrelevant for the first network device, storing the first new value in the first local configuration data store associated with the first network device.

20. The computer program product of claim 18, wherein in the event that the shared configuration object is determined to be irrelevant for the first network device, sending an error message associated with the first request to the central management system.