Network business diagnosis method

Abstract

The embodiment of the invention discloses a network business diagnosis method. The network business diagnosis method provided by the embodiment of the invention comprises the steps of obtaining configuration information of security devices through which business requests pass, wherein the configuration information comprises security policy rules; carrying out preprocessing according to the business requests and the configuration information of the security devices, wherein the preprocessing comprises the process of selecting a corresponding security policy matching mode according to a type ofeach security device, determining incoming interfaces and outgoing interfaces of the security devices through which the business requests pass, and generating to-be-analyzed business requests; matching the to-be-analyzed business requests with the security policy rules of the security devices according to the selected security policy matching modes and a preset matching algorithm, and generating permission condition of each security device for the business requests. According to the technical scheme provided by the embodiment of the invention, when network business diagnosis is carried out, different types of security devices from different factories are compatible, so the practicability of the network business diagnosis method is improved.

Description

technical field [0001] The invention relates to the technical field of network topology, in particular to a method for diagnosing network services. Background technique [0002] With the continuous development of Internet technology and the increasingly complex network environment, network security has become a major concern of enterprises. In order to solve potential security risks in the network, enterprises will deploy security devices such as firewalls in the internal network, especially in companies with complex and large internal networks, multiple security devices will be deployed in the internal network. [0003] At present, when deploying multiple security devices, the internal network is usually divided into multiple areas, and multiple sets of firewall rule sets need to be deployed on these security devices to interconnect different areas. Therefore, the company's internal network security maintenance personnel need to Check carefully to avoid mutual influence of...

AI Technical Summary

Problems solved by technology

[0004] (1) The network service diagnosis tool can only perform service diagnosis on the network of a single manufacturer and type of security equipment, and cannot be compatible with different manufacturers and types of security equipment

[0005] (2) Does not consider the impact of certain behaviors on specific security devices on service requests, such as layer-2 / layer-3 blocking strategies, DNAT address translation, etc.

[0006] (3) There is no effective solution for the situation that the security device does not allow the service request in the network to pass through

[0007] To sum up, although some problems can be solved by using network service diagnosis tools in the prior art, there are still some unsolvable problems, which make the service diagnosis of the company's internal network less practical.

Images