Method and apparatus for network wide policy-based analysis of configurations of devices

Abstract

A method and an apparatus for analyzing a network configuration against a corporate network policy and determining violation(s) against the corporate network policy. A report indicating the violation(s) can be generated indicating instances of the violation(s). An analysis platform reads in a network policy. The analysis platform collects configuration files from the relevant network devices in the network and builds up an internal instance of a network configuration model based on the configuration files and the network topology. The analysis platform analyzes this network configuration model according to the network policy and adds an entry to its final report each time that it detects a violation against the network policy in the network configuration model. The data in the entries pinpoints the cause of the deviation(s) from the network policy.

Description

RELATED APPLICATIONS [0001] This application is related to and claims the benefit of provisional application Ser. No. 60 / 279,190, filed Mar. 27, 2001, the contents of which are hereby incorporated by reference.FIELD OF THE INVENTION [0002] The present invention relates generally to Internet Protocol (IP) network devices, such as firewalls, routers, switches, servers, and more particularly, to a method and apparatus for policy-based analysis of the configurations of the network devices. BACKGROUND OF THE INVENTION [0003] A computer network's basic functionality is determined by the configuration of the network devices present in the network. Network devices include routers, network switches, servers, firewalls, and virtual private networks. [0004] A router is a network gateway that joins two or more IP networks and switches packets between the networks. A network administrator can implement a high-level corporate routing policy by configuring the settings of each router in the networ...

AI Technical Summary

Benefits of technology

"The present invention is a method and apparatus for analyzing a network configuration against a corporate network policy and determining violations. The analysis platform reads in the network policy and collects configuration files from relevant network devices to build up an internal instance of a network configuration model. The analysis platform analyzes this model according to the network policy and adds an entry to its final report each time that it detects a violation. The data in the entries pinpoints the cause of the deviation from the network policy. The network policy describes capabilities for particular hosts in the network and limits the IP traffic from and to these hosts according to the type of service. The network administrator can determine that relevant IP traffic, and only relevant IP traffic, is able to reach the hosts. The network policy also describes routes that the IP traffic should take between different sites of the same enterprise and ensures that the routes taken by the IP traffic within the enterprise adhere to the network policy."

Problems solved by technology

Any error in the configuration file of a single network device can invalidate the enforcement of the network policy.

Furthermore, errors in the configuration files can go undetected for a long time.

For example, a router configuration error can cause IP traffic from the Internet, which is destined for a number of hosts (computers) within the corporate network (enterprise), to be lost.

Images