A network management method, device, apparatus and machine readable storage medium

Abstract

The present disclosure provides a network management method, device, equipment and machine readable storage medium, the method comprising: in response to the event of creating a device, managing the device, and establishing a virtual connection with the device; in response to the event of device configuration issuing, querying at least one idle connection resource in the connection pool; according to the idle connection resource queried, establishing a real connection between the device and the security device through the connection pool, and establishing a mapping relationship between the real connection and the virtual connection established by the device. Through the technical scheme of the present disclosure, the connection with the security device and the managed connection are managed separately, and the devices exceeding the number of devices supported by the security device are managed in a virtual connection. Only when the security service occurs in the device, the physical real connection between the device and the security device is established according to the actual demand, so that the excess devices are managed without changing the number of devices supported by the security device.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of communication technology, and in particular, to a network management method and device, equipment and machine readable storage medium. BACKGROUND

[0002] VCF controller: Virtual Converged Framework controller, is a SDN controller system, as the core control component of AD-DC solution, provides a software platform for data center network, public cloud, private cloud, campus edge network, etc. to play its different network characteristics.

[0003] vSystem: a lightweight virtualization technology, which can divide a physical device into multiple independent logical devices. Each vSystem is equivalent to a real device serving externally, with independent interface, VLAN, routing table item, address range, policy and user / user group.

[0004] The current VCF controller deploys a large number of security services of various types, and the security services eventually need to be landed on security devices such as firewalls and load balancing. The firewall is the most important security device. The firewall device divides a physical device into multiple independent logical devices through virtualization technology vSystem, realizing more network isolation of tenants. Users can manage to establish a connection with the firewall through the management IP address, username, password, connection name, and take the VCF controller as the management device of the vSystem, and issue configurations according to the vSystem name under each vSystem, so as to realize the management of the vSystem virtual device. However, the number of connections supported on the firewall device is limited, and the number of vSystem virtual devices is too large, exceeding the total number of connections supported by the firewall, resulting in that part of the vSystem virtual devices cannot be managed by the VCF controller. SUMMARY

[0005] Therefore, the present disclosure provides a network management method and device, electronic equipment and machine readable storage medium to improve the problem that part of the vSystem devices cannot be managed.

[0006] The specific technical solutions are as follows:

[0007] The present disclosure provides a network management method applied to a vSystem management device, the method comprising: in response to an event of creating a vSystem device, managing the vSystem device and establishing a virtual connection with the vSystem device; in response to an event of vSystem device configuration delivery after the virtual connection is established, querying at least one connection resource in an idle state in a connection pool; according to the queried connection resource in the idle state, establishing a real connection between the vSystem device and a security device through the connection pool, and establishing a mapping relationship between the real connection and the virtual connection established by the vSystem device; the connection pool is established according to network information of the security device, and the total amount of connection resources included in the connection pool is determined according to hardware resources of the security device.

[0008] As a technical solution, in response to the event of vSystem device configuration delivery after the virtual connection is established, the at least one connection resource in the idle state in the connection pool is queried, and the step further comprises: according to the query result of failing to find the connection resource in the idle state, releasing a connection resource used for establishing the real connection, so that the connection resource is used as the connection resource in the idle state which is queried, and the subsequent steps are executed.

[0009] As a technical solution, according to the queried connection resource in the idle state, the real connection between the vSystem device and the security device is established through the connection pool, and the mapping relationship between the real connection and the virtual connection established by the vSystem device is established: according to the at least two connection resources in the idle state which are queried, the states of all vSystem devices which establish the virtual connection and are in the inactive state are switched to the active state.

[0010] As a technical solution, it further comprises: in response to a signaling of removing a target vSystem device, querying the mapping relationship between the real connection and the virtual connection associated with the target vSystem device in a mapping table; if the mapping relationship exists, the mapping relationship between the real connection and the virtual connection is removed and the connection resource associated with the real connection is released; and the virtual connection of the target vSystem device is deleted.

[0011] The present disclosure also provides a network management device applied to a vSystem management device, the device comprising: a connection module configured to, in response to an event of creating a vSystem device, manage the vSystem device and establish a virtual connection with the vSystem device; a query module configured to, in response to an event of configuration issuing of the vSystem device after the virtual connection is established, query at least one connection resource in an idle state in a connection pool; and a processing module configured to, according to the queried connection resource in the idle state, establish a real connection between the vSystem device and a security device through the connection pool, and establish a mapping relationship between the real connection and the virtual connection established by the vSystem device; the connection pool is established according to network information of the security device and is associated with the security device, and the total amount of connection resources included in the connection pool is determined according to hardware resources of the security device.

[0012] As a technical solution, in response to the event of configuration issuing of the vSystem device after the virtual connection is established, the query module queries at least one connection resource in an idle state in the connection pool, and the step further comprises: according to the query result of failing to find the connection resource in the idle state, releasing a connection resource that has been used to establish the real connection, so that the connection resource is used as the connection resource in the idle state that is queried, and the subsequent step is executed.

[0013] As a technical solution, according to the queried connection resource in the idle state, the processing module establishes the real connection between the vSystem device and the security device through the connection pool, and establishes the mapping relationship between the real connection and the virtual connection established by the vSystem device; according to the at least two connection resources in the idle state that are queried, the state of all vSystem devices that have established the virtual connection and are in an inactive state is switched to an active state.

[0014] As a technical solution, the processing module is further configured to: in response to a signaling of removing a target vSystem device, query the mapping relationship between the real connection and the virtual connection associated with the target vSystem device in a mapping table; if the mapping relationship exists, remove the mapping relationship between the real connection and the virtual connection and release the connection resource associated with the real connection; and delete the virtual connection of the target vSystem device.

[0015] The present disclosure also provides an electronic device comprising a processor and a machine readable storage medium, the machine readable storage medium storing machine executable instructions capable of being executed by the processor, and the processor executes the machine executable instructions to implement the network management method.

[0016] The present disclosure also provides a machine readable storage medium storing machine executable instructions, which, when invoked and executed by a processor, cause the processor to implement the network management method.

[0017] The above technical solution provided by the present disclosure has at least the following beneficial effects:

[0018] By managing the connection with the security device and the managed connection separately, the vSystem device exceeding the number of supported security devices is managed by virtual connection, and only when the security service occurs in the vSystem device, the physical real connection between the vSystem device and the security device is established according to the actual demand, so that the excess vSystem device is managed without changing the number of supported connection devices of the security device. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the drawings needed in the description of the embodiments of the present disclosure or the prior art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the present disclosure, and other drawings can also be obtained by those skilled in the art according to these drawings of the embodiments of the present disclosure.

[0020] Figure 1 is a flow chart of the network management method in an embodiment of the present disclosure;

[0021] Figure 2 is a structural diagram of the network management device in an embodiment of the present disclosure;

[0022] Figure 3 is a hardware structural diagram of the electronic device in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments, and are not intended to limit the present disclosure. The singular forms "a", "an" and "the" used in the present disclosure and claims are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein means any or all possible combinations of one or more associated listed items.

[0024] It should be understood that, although the terms first, second, third, etc. can be employed in describing various information in the disclosure implementation, the information should not be limited to these terms. These terms are only used to distinguish one type of information from another type of information. For example, without departing from the scope of the disclosure, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. In addition, depending on the context, the word "if" used can be interpreted as "when" or "upon" or "in response to determining".

[0025] In one technical solution, the firewall hardware device increases the total number of connections supported by itself, and currently supports up to 2000 connections, as many as possible to support vSystem virtual devices to share a connection individually, to ensure the normal processing of security services. However, this technical solution relies too much on firewall hardware resources, and the total number of connections still has a bottleneck. When the number of vSystem virtual devices is greater than the total number of firewall connections, it still cannot completely solve the situation of insufficient connections. And when a certain vSystem device has no security service processing for a long time, it still occupies a connection, wasting firewall resources.

[0026] The present disclosure provides a network management method, device, electronic equipment and machine readable storage medium to improve the above technical problems.

[0027] Specifically, the technical solution is as follows.

[0028] In one embodiment, the present disclosure provides a network management method applied to a vSystem management device, the method comprising: in response to an event of creating a vSystem device, managing the vSystem device and establishing a virtual connection with the vSystem device; in response to an event of configuration issuing of the vSystem device for which the virtual connection is established, querying at least one connection resource in an idle state in a connection pool; according to the queried connection resource in the idle state, establishing a real connection between the vSystem device and a security device through the connection pool, and establishing a mapping relationship between the real connection and the virtual connection established by the vSystem device; the connection pool is established according to the network information of the security device and is associated with the security device, and the total amount of connection resources included in the connection pool is determined according to the hardware resources of the security device.

[0029] Specifically, as Figure 1 , the method comprises the following steps:

[0030] Step S11, in response to an event of creating a vSystem device, managing the vSystem device and establishing a virtual connection with the vSystem device;

[0031] Step S12, in response to the event of the vSystem device configuration being issued, querying at least one idle connection resource in the connection pool;

[0032] Step S13, according to the idle connection resource queried, establishing a real connection between the vSystem device and the security device through the connection pool, and establishing a mapping relationship between the real connection and the virtual connection established by the vSystem device.

[0033] By managing the connections with the security device and the managed connections respectively, the vSystem devices exceeding the number of security devices supported are managed in a virtual connection, and only when the security service occurs in the vSystem device, the physical real connection between the vSystem device and the security device is established according to the actual demand, so that the excess vSystem devices are managed without changing the number of security devices supporting connection devices.

[0034] Wherein the vSystem management device can be a VCF controller or other network management device, and the security device can be a firewall or other network security device.

[0035] In an embodiment, in response to the event of the vSystem device configuration being issued, querying at least one idle connection resource in the connection pool, the step further comprises: according to the query result of failing to find the idle connection resource, releasing a connection resource used to establish a real connection, making the connection resource as the idle connection resource queried, and executing the subsequent steps.

[0036] In an embodiment, according to the idle connection resource queried, the real connection between the vSystem device and the security device is established through the connection pool, and the mapping relationship between the real connection and the virtual connection established by the vSystem device is established: according to the at least two idle connection resources queried, the states of all vSystem devices establishing virtual connections and being in an inactive state are switched to an active state.

[0037] In an embodiment, it further comprises: in response to the signaling of removing the target vSystem device, querying the mapping relationship between the real connection and the virtual connection associated with the target vSystem device in the mapping table; if it exists, removing the mapping relationship between the real connection and the virtual connection and releasing the connection resource associated with the real connection; deleting the virtual connection of the target vSystem device.

[0038] In an embodiment, the vSystem management device VCF controller is realized by software, and all vSystem devices are managed by the VCF controller, each as a hardware firewall management IP of a secure device. One management IP maintains a connection pool, and the total number of connections in the connection pool is set according to the actual performance of the physical device. When a user manages a vSystem device, a virtual connection is created to maintain the state and other information of the device, a physical real connection is created for the configuration of the secure service, and the physical connection is put into the connection pool. When the connections in the connection pool are full, subsequent vSystem devices are managed only by creating a virtual connection, and no physical connection is created. When interaction with the device is needed, the most suitable idle physical connection is obtained according to the situation of each physical connection in the connection pool, and the correspondence between the virtual connection and the physical connection is saved. The VCF controller and all vSystem devices can interact normally.

[0039] The controller manages the vSystem device, creates a virtual connection of the device, and then obtains the physical device to which the vSystem device belongs. According to the management IP of the physical device, it is queried whether a connection pool exists. If not, a connection pool is initialized according to the management IP of the physical device, and the initialization state of the connection pool is init. According to the connection pool of the physical device, it is judged whether the connection resources in the connection pool are full. If not, a real connection of the vSystem device is created and added to the connection pool. It is judged whether the vSystem device connection is online. If it is online, the device connection is set to active, the connection pool state is set to active, and the virtual connection state of all vSystem devices under the physical device is set to active. If the connection resources of the connection pool are exhausted, no real connection of the secure device and the vSystem device is directly created, and the state of the vSystem virtual connection is set according to the state of the connection pool.

[0040] When the vSystem device performs configuration delivery, the vSystem device virtual connection is obtained, and it is judged whether the state is active. If it is, the connection pool is obtained according to the physical device to which the vSystem device belongs, and the virtual connection and device connection mapping table are queried. It is judged whether the vSystem virtual connection exists in the mapped device connection. If not, or if it exists but the device is in an inactive state, all online idle connections in the connection pool are queried, and it is judged whether there is an online idle connection. If there is an online idle connection, the device connection is obtained, added to the virtual connection and device connection mapping relationship table, and the configuration delivery is completed. If there is no online idle connection, an online device is unbound from the virtual connection and device connection mapping table, so that the device connection is idle. Then the device connection is obtained, added to the virtual connection and device connection mapping relationship table, and the configuration delivery is completed.

[0041] When deleting the vSystem device, the virtual connection of the device is deleted first, then the connection pool of the physical device to which the vSystem device belongs is obtained, and whether the virtual connection is mapped with a physical connection is judged according to the mapping table of the virtual connection and the physical connection. If there is, the mapping relationship between the virtual connection and the physical connection is released, and the physical connection becomes an idle connection.

[0042] In an embodiment, the present disclosure simultaneously provides a network management device, such as Figure 2 , applied to a vSystem management device, the device comprising: a connection module 21, configured to, in response to an event of creating a vSystem device, manage the vSystem device and establish a virtual connection with the vSystem device; a query module 22, configured to, in response to an event of configuration issuing of the vSystem device with which the virtual connection is established, query at least one connection resource in an idle state in a connection pool; and a processing module 23, configured to, according to the queried connection resource in the idle state, establish a real connection between the vSystem device and a security device through the connection pool, and establish a mapping relationship between the real connection and the virtual connection established by the vSystem device. The connection pool is established according to the network information of the security device and is associated with the security device, and the total amount of the connection resources included in the connection pool is determined according to the hardware resources of the security device.

[0043] In an embodiment, in response to the event of configuration issuing of the vSystem device with which the virtual connection is established, the query module 22 is further configured to, according to the query result of failing to find the connection resource in the idle state, release a connection resource that has been used to establish the real connection, so that the connection resource is used as the connection resource in the idle state that is queried, and the subsequent steps are executed.

[0044] In an embodiment, according to the queried connection resource in the idle state, the processing module 23 is further configured to, through the connection pool, establish the real connection between the vSystem device and the security device, and establish the mapping relationship between the real connection and the virtual connection established by the vSystem device. According to the at least two connection resources in the idle state that are queried, the states of all the vSystem devices with which the virtual connection is established and in the inactive state are switched to the active state.

[0045] In an embodiment, the processing module is further configured to, in response to a signaling of removing a target vSystem device, query the mapping relationship between the real connection and the virtual connection associated with the target vSystem device in the mapping table. If there is, the mapping relationship between the real connection and the virtual connection is released, and the connection resource associated with the real connection is released. The virtual connection of the target vSystem device is deleted.

[0046] The apparatus embodiments and the corresponding method embodiments are the same or similar, and will not be described here.

[0047] In an embodiment, the present disclosure provides an electronic device, comprising a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions which can be executed by the processor, the processor executes the machine executable instructions to implement the aforementioned network management method. From the hardware level, the hardware architecture diagram can refer to Figure 3 as shown.

[0048] In an embodiment, the present disclosure provides a machine readable storage medium, the machine readable storage medium stores machine executable instructions, when the machine executable instructions are invoked and executed by a processor, the machine executable instructions cause the processor to implement the aforementioned network management method.

[0049] Here, the machine readable storage medium can be any electronic, magnetic, optical, or other physical storage apparatus, and can contain or store information such as executable instructions, data, and the like. For example, the machine readable storage medium can be a RAM (Random Access Memory), a volatile memory, a non-volatile memory, a flash memory, a storage drive (such as a hard drive), a solid state drive, any type of storage disk (such as an optical disk, a DVD, etc.), or similar storage medium, or a combination thereof.

[0050] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, and the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an e-mail device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0051] For the convenience of description, the above apparatuses are described in various units by functions respectively. Of course, the functions of each unit can be implemented in the same or more software and / or hardware when implementing the present disclosure.

[0052] Those skilled in the art will understand that the embodiments of the present disclosure can be provided as a method, a system, or a computer program product. Therefore, the present disclosure can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present disclosure can take the form of a computer program product implemented on one or more computer usable storage media (including, but not limited to, magnetic disks, CD-ROMs, optical storage media, etc.) containing computer usable program code.

[0053] The embodiments of methods, apparatuses (systems) and computer program products according to the present disclosure can be described with reference to flowcharts and / or block diagrams illustrating the apparatus (system) according to the embodiments of the present disclosure. It will be understood that each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing element or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0054] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0055] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0056] Those skilled in the art will appreciate that embodiments of the present disclosure can be devised for a method, a system or a computer program product. Accordingly, the present disclosure can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present disclosure can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer program code thereon for use by or in connection with an instruction execution system. These computer program products can provide any one of the capabilities or functions described herein.

[0057] The embodiments described above are only for the purpose of illustrating the present disclosure and should not be used to limit the present disclosure. The present disclosure can have various modifications and changes for those skilled in the art. Any modifications, equivalent replacements, improvements, etc. within the spirit and principles of the present disclosure should be included in the scope of claims of the present disclosure.

Claims

1. A network management method characterized by comprising: The method is applied to a vSystem management device, and comprises the following steps: In response to an event of creating a vSystem device, the vSystem device is managed, and a virtual connection with the vSystem device is established; In response to an event of a vSystem device configured to be established with a virtual connection, at least one connection resource in an idle state in a connection pool is queried; According to the queried connection resource in the idle state, a real connection between the vSystem device and a security device is established through the connection pool, and a mapping relationship between the real connection and the virtual connection established by the vSystem device is established; The connection pool is established according to network information of the security device, and the total amount of the connection resources included in the connection pool is determined according to hardware resources of the security device.

2. The method of claim 1, wherein, In response to the event of the vSystem device configured to be established with the virtual connection, at least one connection resource in an idle state in the connection pool is queried, and the step further comprises the following steps: According to the query result that the connection resource in the idle state cannot be found, a connection resource used to establish the real connection is released, so that the connection resource is used as the connection resource in the idle state which is queried, and the subsequent steps are executed.

3. The method of claim 1, wherein, According to the queried connection resource in the idle state, the real connection between the vSystem device and the security device is established through the connection pool, and the mapping relationship between the real connection and the virtual connection established by the vSystem device is established: According to the queried at least two connection resources in the idle state, the state of all the vSystem devices established with the virtual connection and in the inactive state is switched to the active state.

4. The method of claim 1, wherein, Further comprising the following steps: In response to a signaling of removing a target vSystem device, a mapping relationship between a real connection and a virtual connection associated with the target vSystem device in a mapping table is queried; If the mapping relationship exists, the mapping relationship between the real connection and the virtual connection is released, and a connection resource associated with the real connection is released; The virtual connection of the target vSystem device is deleted.

5. A network management apparatus characterized by comprising: The device is applied to a vSystem management device, and comprises the following steps: A connection module is configured to, in response to an event of creating a vSystem device, manage the vSystem device, and establish a virtual connection with the vSystem device; A query module is configured to, in response to an event of a vSystem device configured to be established with a virtual connection, query at least one connection resource in an idle state in a connection pool; A processing module is configured to, according to the queried connection resource in the idle state, establish a real connection between the vSystem device and a security device through the connection pool, and establish a mapping relationship between the real connection and the virtual connection established by the vSystem device; The connection pool is established according to network information of the security device, and the total amount of the connection resources included in the connection pool is determined according to hardware resources of the security device.

6. The apparatus of claim 5, wherein, In response to the event of the vSystem device configured to be established with the virtual connection, at least one connection resource in an idle state in the connection pool is queried, and the step further comprises the following steps: According to the query result of failing to find the connection resource in the idle state, a connection resource used for establishing the real connection is released, the connection resource is used as the connection resource in the idle state which is queried, and subsequent steps are executed.

7. The apparatus of claim 5, wherein, According to the connection resource in the idle state which is queried, the real connection between the vSystem device and the security device is established through the connection pool, and a mapping relationship between the real connection and the virtual connection established by the vSystem device is established. According to the at least two connection resources in the idle state which are queried, the state of all the vSystem devices which have established the virtual connection and are in the inactive state is switched to the active state.

8. The apparatus of claim 5, wherein, The processing module is further configured to: in response to the signaling of removing the target vSystem device, query the mapping relationship between the real connection and the virtual connection associated with the target vSystem device in the mapping table; if the mapping relationship exists, remove the mapping relationship between the real connection and the virtual connection and release the connection resource associated with the real connection; delete the virtual connection of the target vSystem device.

9. An electronic device, comprising: comprise: a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions which can be executed by the processor, and the processor executes the machine executable instructions to implement the method in any one of claims 1-4.

10. A machine-readable storage medium, characterized in that, The machine readable storage medium stores machine executable instructions, and when the machine executable instructions are called and executed by the processor, the machine executable instructions cause the processor to implement the method in any one of claims 1-4.

Images