A configuration checking method and device of a network device, a storage medium and a device

Abstract

The application discloses a configuration checking method and device of a network device, a storage medium and equipment, acquires a local IP address and a remote IP address from an access relationship, determines an access relationship strategy according to the local IP address and the remote IP address, acquires a specific control point from a first preset table when the access relationship strategy is a preset strategy, acquires a checking item attribute from the access relationship strategy according to the specific control point, generates a checking result based on the access relationship and the checking item attribute, and shows the checking result to a user through a preset interface. Compared with the prior art, the configuration situation of the network device does not need to be analyzed manually, and therefore, the operation and maintenance efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information checking, and in particular to a network device configuration checking method and device, a storage medium and equipment. BACKGROUND

[0002] With the widespread use of network services and applications, network device configuration management is becoming increasingly important in operation and maintenance work.

[0003] Currently, the Simple Network Management Protocol (SNMP), the network monitoring technology (Telemetry) for remotely and rapidly collecting data from devices, and the network configuration protocol (Netconf) can be used to check the configuration of network devices and determine whether the configuration of the network devices complies with network policies. However, since the configuration of network devices can only be obtained in batches through SNMP, Telemetry, and Netconf, the configuration of network devices cannot be directly compared with the overall network policy. Therefore, manual analysis of the configuration of network devices is required, which results in low operation and maintenance efficiency.

[0004] Therefore, how to improve operation and maintenance efficiency has become a problem that needs to be solved by those skilled in the art. SUMMARY

[0005] The present application provides a network device configuration checking method and device, a storage medium and equipment, aiming to improve operation and maintenance efficiency.

[0006] To achieve the above purpose, the present application provides the following technical solutions:

[0007] A network device configuration checking method comprises the following steps:

[0008] An access relationship is obtained, wherein the access relationship comprises at least an original access relationship and a target access relationship, the original access relationship is obtained from a work order system in advance, and the target access relationship is obtained by converting the original access relationship in advance;

[0009] An access relationship policy is determined according to the local IP address and the opposite IP address;

[0010] When the access relationship policy is a preset policy, a specific control point is obtained from a first preset table;

[0011] An inspection item attribute is obtained from the access relationship policy according to the specific control point;

[0012] An inspection result is generated based on the access relationship and the inspection item attribute, and the inspection result is displayed to a user through a preset interface.

[0013] Optionally, the determining the access relationship policy according to the local IP address and the remote IP address comprises:

[0014] determining whether the first preset table contains a security zone corresponding to the local IP address and the remote IP address;

[0015] if the first preset table contains the security zone corresponding to the local IP address and the remote IP address, determining whether a target relationship policy corresponding to the security zone is contained in a second preset table;

[0016] if the second preset table contains the target relationship policy corresponding to the security zone, obtaining the target relationship policy from the second preset table;

[0017] determining the target relationship policy as the access relationship policy.

[0018] Optionally, after the determining whether the first preset table contains the security zone corresponding to the local IP address and the remote IP address, the method further comprises:

[0019] if the first preset table does not contain the security zone corresponding to the local IP address and the remote IP address, displaying prompt information of stopping checking the access relationship to a user through a preset interface.

[0020] Optionally, after the determining whether the second preset table contains the target relationship policy corresponding to the security zone, the method further comprises:

[0021] if the second preset table does not contain the target relationship policy corresponding to the security zone, displaying prompt information of stopping checking the access relationship to a user through a preset interface.

[0022] Optionally, the method further comprises:

[0023] when the access relationship policy is not the preset policy, determining whether the access relationship policy contains the intermediate control point;

[0024] if the access relationship policy contains the intermediate control point, obtaining the intermediate control point from the first preset table according to the local IP address and the remote IP address.

[0025] Optionally, the method further comprises:

[0026] obtaining an inspection item attribute from the access relationship policy according to the intermediate control point.

[0027] A configuration checking device of a network device, comprising:

[0028] The first obtaining unit is configured to obtain a local IP address and a remote IP address from an access relationship; the access relationship comprises at least an original access relationship and a target access relationship; the original access relationship is obtained from a work order system in advance; and the target access relationship is obtained by converting the original access relationship in advance;

[0029] The determining unit is configured to determine an access relationship policy according to the local IP address and the remote IP address.

[0030] The second obtaining unit is configured to obtain a specific control point from a first preset table when the access relationship policy is a preset policy.

[0031] The third obtaining unit is configured to obtain an inspection item attribute from the access relationship policy according to the specific control point.

[0032] The generating unit is configured to generate an inspection result based on the access relationship and the inspection item attribute, and display the inspection result to a user through a preset interface.

[0033] Optionally, the determining unit is specifically configured to:

[0034] determine whether a security zone corresponding to the local IP address and the remote IP address is included in the first preset table;

[0035] if the security zone corresponding to the local IP address and the remote IP address is included in the first preset table, determine whether a target relationship policy corresponding to the security zone is included in a second preset table;

[0036] if the target relationship policy corresponding to the security zone is included in the second preset table, obtain the target relationship policy from the second preset table;

[0037] determine the target relationship policy as an access relationship policy.

[0038] A computer readable storage medium comprises a stored program, wherein the program is run by a processor to execute the configuration inspection method of the network device.

[0039] A configuration inspection device of a network device comprises a processor, a memory and a bus; the processor is connected with the memory through the bus;

[0040] The memory is configured to store a program, and the processor is configured to run the program, wherein the program is run by the processor to execute the configuration inspection method of the network device.

[0041] The technical scheme provided in the application obtains a local IP address and a remote IP address from an access relationship, determines an access relationship policy according to the local IP address and the remote IP address, obtains a specific control point from a first preset table when the access relationship policy is a preset policy, obtains an inspection item attribute from the access relationship policy according to the specific control point, generates an inspection result based on the access relationship and the inspection item attribute, and displays the inspection result to a user through a preset interface, compared with the prior art, the configuration situation of the network device does not need to be analyzed manually, and therefore, the operation and maintenance efficiency is improved. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical schemes in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0043] Figure 1a A flowchart of a network device configuration checking method provided by an embodiment of the present application;

[0044] Figure 1b A flowchart of a network device configuration checking method provided by an embodiment of the present application;

[0045] Figure 2 A flowchart of another network device configuration checking method provided by an embodiment of the present application;

[0046] Figure 3 An architectural schematic diagram of a network device configuration checking device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0047] The technical schemes in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort fall within the scope of protection of the present application.

[0048] As shown in Figure 1a , Figure 1b A flowchart of a network device configuration checking method provided by an embodiment of the present application, including:

[0049] S101: Obtain an original access relationship from a work order system.

[0050] The original access relationship indicates a relationship of accessing the opposite end by the local end, and the access relationship sent by the user is pre-stored in the work order system.

[0051] S102: Obtain the local IP address and the opposite IP address from the original access relationship.

[0052] The specific implementation of obtaining the local IP address and the opposite IP address from the original access relationship is common knowledge in the art, and will not be described here.

[0053] It should be noted that obtaining the local IP address and the opposite IP address from the original access relationship lays a foundation for subsequent steps.

[0054] S103: Determine whether the first preset table contains a security zone corresponding to the local IP address and the opposite IP address.

[0055] If the first preset table contains a security zone corresponding to the local IP address and the opposite IP address, S104 is executed, otherwise S105 is executed.

[0056] The first preset table includes but is not limited to a regional control point management table, and the security zone indicates a region formed by a security division level of each region of the network.

[0057] Specifically, if the first preset table contains a security zone corresponding to the local IP address and the opposite IP address, it is determined whether the first preset table contains a security zone corresponding to the local IP address and the opposite IP address. Obviously, the first preset table contains a security zone corresponding to the local IP address and the opposite IP address, and therefore S104 is continued to be executed.

[0058] S104: Determine whether the second preset table contains a target relationship strategy corresponding to the security zone.

[0059] If the second preset table contains a target relationship strategy corresponding to the security zone, S106 is executed, otherwise S108 is executed.

[0060] The target relationship strategy indicates a specification requirement of regional management.

[0061] Specifically, if the second preset table contains a target relationship strategy corresponding to the security zone, it is determined whether the second preset table contains a target relationship strategy corresponding to the security zone. Obviously, the second preset table contains a target relationship strategy corresponding to the security zone, and therefore S106 is continued to be executed.

[0062] S105: Show the user a prompt information of stopping checking the original access relationship through a preset interface.

[0063] It should be noted that when the first preset table does not contain the security zone corresponding to the local IP address and the remote IP address, the preset interface is used to show the user a prompt message of stopping checking the original access relationship.

[0064] S106: Obtain the target relationship policy from the second preset table, and determine the target relationship policy as the access relationship policy.

[0065] S107: Determine whether the access relationship policy is a preset policy.

[0066] If the access relationship policy is the preset policy, S109 is executed, otherwise S110 is executed.

[0067] The access relationship policy includes but is not limited to a detailed control policy and a large segment release, and the preset policy indicates the detailed control policy.

[0068] Specifically, assuming that the access relationship policy is the detailed control policy and the preset policy is the detailed control policy, it is determined that the access relationship policy is the preset policy, and therefore S109 is continuously executed.

[0069] Specifically, assuming that the access relationship policy is the large segment release and the preset policy is the detailed control policy, it is determined that the access relationship policy is not the preset policy, and therefore S110 is continuously executed.

[0070] S108: Show the user a prompt message of stopping checking the original access relationship through the preset interface.

[0071] It should be noted that when the second preset table does not contain the access relationship policy corresponding to the security zone, the preset interface is used to show the user a prompt message of stopping checking the original access relationship.

[0072] S109: Obtain the specific control point from the first preset table.

[0073] After S109 is executed, S113 is continuously executed.

[0074] S110: Determine whether the access relationship policy contains the intermediate control point.

[0075] If the access relationship policy contains the intermediate control point, S111 is executed, otherwise S112 is executed.

[0076] Specifically, assuming that the access relationship policy contains the intermediate control point, it is determined that the access relationship policy contains the intermediate control point, and therefore S111 is continuously executed.

[0077] S111: obtaining the intermediate control point from the first preset table according to the local IP address and the remote IP address.

[0078] After S111 is executed, S113 is executed.

[0079] It should be noted that the specific implementation of obtaining the intermediate control point from the first preset table according to the local IP address and the remote IP address is common knowledge to those skilled in the art, and will not be described here.

[0080] S112: determining that the access relationship policy does not contain the control point.

[0081] S113: obtaining the inspection item attribute from the access relationship policy according to the control point.

[0082] The control point includes at least the intermediate control point and the specific control point, and the inspection item attribute includes but is not limited to the antivirus detection in the access relationship policy, the safety approval attribute, etc.

[0083] S114: converting the original access relationship to obtain a target conversion relationship.

[0084] It should be noted that the specific implementation process of converting the original access relationship is to convert the local in the original access relationship into the remote, and to convert the remote in the original access relationship into the local.

[0085] S115: generating an inspection result based on the access relationship policy and the inspection item attribute after a preset step is executed on the target conversion relationship.

[0086] The preset step is to obtain the local IP address and the remote IP address from the target conversion relationship, determine the access relationship policy according to the local IP address and the remote IP address, obtain the specific control point from the first preset table when the access relationship policy is a preset policy, obtain the intermediate control point from the first preset table when the access relationship policy is not the preset policy and the access relationship policy contains the intermediate control point, and obtain the inspection item attribute from the access relationship policy.

[0087] It should be noted that when the access relationship policy is detailed control, the specific policy is control; when the access relationship policy is large segment release, but the access relationship policy contains the intermediate control point, the specific policy is control; and when the access relationship policy is large segment release and does not contain the intermediate control point, the specific policy is release.

[0088] S116: displaying the inspection result to the user through a preset interface.

[0089] In summary, when the access relationship strategy is a preset strategy, the specific control point is obtained from the first preset table, when the access relationship strategy is not a preset strategy, it is judged whether the access relationship strategy contains an intermediate control point, if the access relationship strategy contains an intermediate control point, the intermediate control point is obtained from the first preset table according to the local IP address and the opposite IP address, the original access relationship is converted to obtain a target conversion relationship, after the preset steps are performed on the target conversion relationship, the check result is generated based on the access relationship strategy and the check item attribute, compared with the prior art, the configuration situation of the network device does not need to be analyzed manually, therefore, the operation and maintenance efficiency is improved.

[0090] As shown in Figure 2 , a flow chart of another configuration checking method of a network device provided by the embodiment of the application, comprising:

[0091] S201: obtaining the local IP address and the opposite IP address from the access relationship.

[0092] The access relationship at least includes an original access relationship and a target access relationship, the original access relationship is obtained from a work order system in advance, and the target access relationship is obtained by converting the original access relationship in advance.

[0093] S202: determining the access relationship strategy according to the local IP address and the opposite IP address.

[0094] S203: when the access relationship strategy is a preset strategy, obtaining the specific control point from the first preset table.

[0095] S204: obtaining the check item attribute from the access relationship strategy according to the specific control point.

[0096] S205: generating the check result based on the access relationship and the check item attribute, and showing the check result to the user through a preset interface.

[0097] In summary, when the access relationship strategy is a preset strategy, the specific control point is obtained from the first preset table, when the access relationship strategy is not a preset strategy, it is judged whether the access relationship strategy contains an intermediate control point, if the access relationship strategy contains an intermediate control point, the intermediate control point is obtained from the first preset table according to the local IP address and the opposite IP address, the original access relationship is converted to obtain a target conversion relationship, after the preset steps are performed on the target conversion relationship, the check result is generated based on the access relationship strategy and the check item attribute, compared with the prior art, the configuration situation of the network device does not need to be analyzed manually, therefore, the operation and maintenance efficiency is improved.

[0098] As shown in Figure 3 , an architecture schematic diagram of a configuration checking device of a network device provided by the embodiment of the application, comprising:

[0099] The first obtaining unit 100 is configured to obtain a local IP address and a remote IP address from an access relationship; the access relationship at least includes an original access relationship and a target access relationship; the original access relationship is obtained from a work order system in advance; and the target access relationship is obtained by converting the original access relationship in advance.

[0100] The determining unit 200 is configured to determine an access relationship policy according to the local IP address and the remote IP address.

[0101] The determining unit 200 is specifically configured to: determine whether the first preset table contains a security zone corresponding to the local IP address and the remote IP address; if the first preset table contains the security zone corresponding to the local IP address and the remote IP address, determine whether the second preset table contains a target relationship policy corresponding to the security zone; if the second preset table contains the target relationship policy corresponding to the security zone, obtain the target relationship policy from the second preset table; and determine the target relationship policy as the access relationship policy.

[0102] The determining unit 200 is further configured to, if the first preset table does not contain the security zone corresponding to the local IP address and the remote IP address, display prompt information for stopping checking the access relationship to a user through a preset interface.

[0103] The determining unit 200 is further configured to, if the second preset table does not contain the target relationship policy corresponding to the security zone, display prompt information for stopping checking the access relationship to a user through a preset interface.

[0104] The second obtaining unit 300 is configured to obtain a specific control point from the first preset table when the access relationship policy is a preset policy.

[0105] The second obtaining unit 300 is further configured to, when the access relationship policy is not the preset policy, determine whether the access relationship policy contains an intermediate control point; and if the access relationship policy contains the intermediate control point, obtain the intermediate control point from the first preset table according to the local IP address and the remote IP address.

[0106] The second obtaining unit 300 is further configured to obtain an inspection item attribute from the access relationship policy according to the intermediate control point.

[0107] The third obtaining unit 400 is configured to obtain an inspection item attribute from the access relationship policy according to the specific control point.

[0108] The generating unit 500 is configured to generate a checking result based on the access relationship and the inspection item attribute, and display the checking result to a user through a preset interface.

[0109] In summary, when the access relationship policy is a preset policy, the specific control point is obtained from the first preset table, when the access relationship policy is not a preset policy, it is judged whether the access relationship policy contains an intermediate control point, if the access relationship policy contains an intermediate control point, the intermediate control point is obtained from the first preset table according to the local IP address and the opposite IP address, the original access relationship is converted to obtain a target conversion relationship, after the preset steps are performed on the target conversion relationship, the check result is generated based on the access relationship policy and the check item attribute, compared with the prior art, the configuration of the network device does not need to be analyzed manually, therefore, the operation and maintenance efficiency is improved.

[0110] The application further provides a computer readable storage medium, which comprises a stored program, wherein the program executes the network device configuration checking method provided by the application.

[0111] The application further provides a network device configuration checking device, which comprises a processor, a memory and a bus. The processor is connected with the memory through the bus, the memory is used for storing a program, and the processor is used for running the program, wherein the program executes the network device configuration checking method provided by the application when running, and comprises the following steps:

[0112] The local IP address and the opposite IP address are obtained from the access relationship; the access relationship at least comprises an original access relationship and a target access relationship; the original access relationship is obtained from a work order system in advance; and the target access relationship is obtained by converting the original access relationship in advance;

[0113] The access relationship policy is determined according to the local IP address and the opposite IP address;

[0114] When the access relationship policy is a preset policy, the specific control point is obtained from the first preset table;

[0115] The check item attribute is obtained from the access relationship policy according to the specific control point;

[0116] The check result is generated based on the access relationship and the check item attribute, and the check result is displayed to the user through a preset interface.

[0117] Optionally, the access relationship policy is determined according to the local IP address and the opposite IP address, and the method comprises:

[0118] It is judged whether the first preset table contains a security area corresponding to the local IP address and the opposite IP address;

[0119] If the first preset table contains the security zone corresponding to the local IP address and the opposite IP address, it is judged whether the second preset table contains a target relationship policy corresponding to the security zone.

[0120] If the second preset table contains the target relationship policy corresponding to the security zone, the target relationship policy is acquired from the second preset table.

[0121] The target relationship policy is determined as an access relationship policy.

[0122] Optionally, after judging whether the first preset table contains the security zone corresponding to the local IP address and the opposite IP address, the method further comprises:

[0123] If the first preset table does not contain the security zone corresponding to the local IP address and the opposite IP address, a prompt information of stopping checking the access relationship is displayed to the user through a preset interface.

[0124] Optionally, after judging whether the second preset table contains the target relationship policy corresponding to the security zone, the method further comprises:

[0125] If the second preset table does not contain the target relationship policy corresponding to the security zone, a prompt information of stopping checking the access relationship is displayed to the user through a preset interface.

[0126] Optionally, the method further comprises:

[0127] When the access relationship policy is not the preset policy, it is judged whether the access relationship policy contains the intermediate control point.

[0128] If the access relationship policy contains the intermediate control point, the intermediate control point is acquired from the first preset table according to the local IP address and the opposite IP address.

[0129] Optionally, the method further comprises:

[0130] According to the intermediate control point, an inspection item attribute is acquired from the access relationship policy.

[0131] If the functions of the method of the embodiments of the present application are realized in the form of software function units and sold or used as independent products, they can be stored in a computer device readable storage medium. Based on this understanding, the part of the prior art or the part of the technical solution of the embodiments of the present application that makes contributions to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, a mobile computing device or a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk and various program code storage media.

[0132] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0133] The above description of the disclosed embodiments enables a person skilled in the art to implement or use the present application. Various modifications to the embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for checking the configuration of a network device, characterized in that, include: Obtain the local IP address and the peer IP address from the access relationship; the access relationship includes at least the original access relationship and the target access relationship; The original access relationship is obtained in advance from the work order system; the target access relationship is obtained in advance by converting the original access relationship. Based on the local IP address and the peer IP address, determine the access relationship strategy; When the access relationship strategy is a preset strategy, the specific control point is obtained from the first preset table; Based on the specific control point, obtain the check item attributes from the access relationship policy; Based on the access relationship and the inspection item attributes, inspection results are generated and displayed to the user through a preset interface.

2. The method according to claim 1, characterized in that, The step of determining the access relationship strategy based on the local IP address and the peer IP address includes: Determine whether the first preset table contains a security zone corresponding to the local IP address and the peer IP address; If the first preset table contains the security zone corresponding to the local IP address and the peer IP address, then determine whether the second preset table contains the target relationship strategy corresponding to the security zone; If the second preset table contains the target relationship strategy corresponding to the security zone, then the target relationship strategy is obtained from the second preset table; The target relationship strategy is determined to be an access relationship strategy.

3. The method according to claim 2, characterized in that, After determining whether the first preset table contains a security zone corresponding to the local IP address and the peer IP address, the method further includes: If the first preset table does not contain the security zone corresponding to the local IP address and the peer IP address, a prompt message to stop checking the access relationship will be displayed to the user through a preset interface.

4. The method according to claim 2, characterized in that, After determining whether the second preset table contains a target relationship strategy corresponding to the security zone, the method further includes: If the second preset table does not contain the target relationship policy corresponding to the security zone, a prompt message to stop checking the access relationship will be displayed to the user through a preset interface.

5. The method according to claim 1, characterized in that, Also includes: When the access relationship policy is not the preset policy, determine whether the access relationship policy contains an intermediate control point; If the access relationship policy includes the intermediate control point, the intermediate control point is obtained from the first preset table based on the local IP address and the peer IP address.

6. The method according to claim 5, characterized in that, Also includes: Based on the intermediate control point, the check item attributes are obtained from the access relationship policy.

7. A configuration checking device for a network device, characterized in that, include: The first acquisition unit is used to acquire the local IP address and the peer IP address from the access relationship; the access relationship includes at least the original access relationship and the target access relationship; The original access relationship is obtained in advance from the work order system; the target access relationship is obtained in advance by converting the original access relationship. The determining unit is used to determine the access relationship strategy based on the local IP address and the peer IP address; The second acquisition unit is used to acquire a specific control point from the first preset table when the access relationship strategy is a preset strategy; The third acquisition unit is used to acquire the check item attribute from the access relationship policy based on the specific control point; The generation unit is used to generate inspection results based on the access relationship and the inspection item attributes, and to display the inspection results to the user through a preset interface.

8. The apparatus according to claim 7, characterized in that, The determining unit is specifically used for: Determine whether the first preset table contains a security zone corresponding to the local IP address and the peer IP address; If the first preset table contains the security zone corresponding to the local IP address and the peer IP address, then determine whether the second preset table contains the target relationship strategy corresponding to the security zone; If the second preset table contains the target relationship strategy corresponding to the security zone, then the target relationship strategy is obtained from the second preset table; The target relationship strategy is determined to be an access relationship strategy.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed by a processor, performs the configuration checking method for the network device according to any one of claims 1-6.

10. A configuration checking device for network devices, characterized in that, include: Processor, memory, and bus; The processor and the memory are connected via the bus; The memory is used to store a program, and the processor is used to run the program, wherein the program is executed by the processor to perform the configuration check method of the network device according to any one of claims 1-6.

Images