Firewall configuration method and device, electronic equipment and computer readable storage medium

Abstract

The application provides a firewall configuration method and device, electronic equipment and a computer readable storage medium. The method comprises: receiving a firewall configuration request for a target cloud network service, wherein the firewall configuration request carries an identifier of a target resource pool corresponding to the target cloud network service; obtaining a target network configuration session corresponding to the target resource pool based on the identifier of the target resource pool; constructing a first message in the target network configuration session, wherein the first message carries a firewall configuration parameter; and sending the first message to a target firewall corresponding to the target resource pool through the target network configuration session, so that the target firewall performs parameter configuration based on the firewall configuration parameter. Through the application, the efficiency of configuring the firewall can be improved.

Description

Technical Field

[0001] This application relates to computer technology, and more particularly to a firewall configuration method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] In recent years, with the active innovation in the global cloud computing field and the popularization of cloud computing in my country, more and more enterprises have begun to adopt cloud computing technology to deploy information systems, and their awareness and ability to migrate to the cloud are constantly increasing. Cloud-network convergence is a conceptual model based on the profound changes in network architecture driven by parallel business needs and technological innovation, enabling the cloud and network to highly collaborate, support each other, and learn from each other. During the process of enterprise cloud migration, most cloud network traffic (especially leased line traffic) will pass through firewalls. Firewalls are not only a network security barrier, but also have VPN (Virtual Private Network) and Network Address Translation (NAT) functions; therefore, firewall configuration is crucial.

[0003] The current firewall configuration method typically involves the platform notifying the relevant network configuration personnel via SMS or email when the cloud network service process reaches the cloud-based firewall configuration stage. Upon receiving the work order, the network configuration personnel log into the order management system to collect order information, then log into the firewall device and manually configure the parameters of the current cloud network service using commands. After configuration, they also need to verify the correctness of the configuration. This method is inefficient. Work orders may not be received immediately by the network configuration personnel, and even after receiving the task, they still need to manually execute numerous commands based on the order information, which is time-consuming and inefficient. Furthermore, configuring firewall devices requires highly skilled operators because the process involves many complex commands. Any error in a command requires significant time for troubleshooting or even rollback. When a large number of services need to be activated, the workload of network configuration personnel increases, further hindering activation efficiency. Summary of the Invention

[0004] This application provides a firewall configuration method, apparatus, electronic device, and computer-readable storage medium, which can improve the efficiency of firewall configuration.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides a firewall configuration method, applied to a firewall configuration device, including:

[0007] Receive a firewall configuration request for a target cloud network service, wherein the firewall configuration request carries the identifier of the target resource pool corresponding to the target cloud network service;

[0008] Based on the identifier of the target resource pool, obtain the target network configuration session corresponding to the target resource pool;

[0009] A first packet is constructed in the target network configuration session, the first packet carrying firewall configuration parameters;

[0010] The first message is sent to the target firewall corresponding to the target resource pool through the target network configuration session, so that the target firewall can configure parameters based on the firewall configuration parameters.

[0011] In the above scheme, obtaining the target network configuration session corresponding to the target resource pool based on the identifier of the target resource pool includes:

[0012] Obtain the mapping between resource pool identifiers and session pools;

[0013] Based on the correspondence and the identifier of the target resource pool, the session pool corresponding to the target resource pool is obtained;

[0014] Idle network configuration sessions are determined from the session pool corresponding to the target resource pool, and the target network configuration session is determined from the determined network configuration sessions.

[0015] In the above scheme, determining the network configuration session in an idle state from the session pool corresponding to the target resource pool includes:

[0016] Obtain the status information of each network configuration session in the session pool;

[0017] Based on the status information of each network configuration session, determine the network configuration sessions in the session pool that are in an idle state.

[0018] The method in the above scheme further includes:

[0019] Update the status information of the target network configuration session to non-idle state.

[0020] In the above scheme, before receiving the firewall configuration request for the target cloud network service, the method further includes:

[0021] Construct session pools for at least two resource pools, with each resource pool corresponding to a cloud network service;

[0022] Obtain the identifier of each of the at least two resource pools;

[0023] Based on the identifier of each resource pool in the at least two resource pools and the corresponding session pool, a correspondence between the identifier of the resource pool and the session pool is constructed.

[0024] In the above scheme, constructing a session pool for at least two resource pools includes:

[0025] Obtain the performance parameters of the network configuration device;

[0026] Based on the performance parameters and the number of resource pools of the at least two resource pools, a session pool is constructed for the at least two resource pools.

[0027] In the above scheme, constructing a session pool for at least two resource pools based on the performance parameters and the number of resource pools of the at least two resource pools includes:

[0028] Based on the performance parameters and the number of resource pools of the at least two resource pools, determine the number of network configuration sessions corresponding to each resource pool;

[0029] Based on the number of sessions, construct a session pool for at least two resource pools;

[0030] The number of network configuration sessions contained in each session pool is the number of sessions.

[0031] The method in the above scheme further includes:

[0032] Obtain the number of network configuration sessions that are idle in the target resource pool;

[0033] When the number of idle network configuration sessions is less than or equal to the number threshold, create a new network resource configuration session.

[0034] Add the created network resource configuration session to the target resource pool.

[0035] In the above scheme, before constructing the first packet in the target network configuration session, the method further includes:

[0036] A second message is constructed in the target network configuration session, the second message carrying the initial configuration parameters of the target firewall;

[0037] The second message is sent to the target firewall through the target network configuration session;

[0038] The second message is used by the target firewall to perform data rollback based on the second message when an anomaly occurs in parameter configuration based on the first message, so as to roll back the configuration parameters of the target firewall to the initial configuration parameters.

[0039] This application provides a firewall configuration device, including:

[0040] The receiving module is used to receive a firewall configuration request for a target cloud network service, wherein the firewall configuration request carries the identifier of the target resource pool corresponding to the target cloud network service;

[0041] The acquisition module is used to obtain the target network configuration session corresponding to the target resource pool based on the identifier of the target resource pool;

[0042] The building module is used to build a first packet in the target network configuration session, the first packet carrying firewall configuration parameters;

[0043] The sending module is used to send the first message to the target firewall corresponding to the target resource pool through the target network configuration session, so that the target firewall can perform parameter configuration based on the firewall configuration parameters.

[0044] This application provides an electronic device, including:

[0045] Memory, used to store executable instructions;

[0046] The processor, when executing executable instructions stored in the memory, implements the firewall configuration method provided in the embodiments of this application.

[0047] This application provides a computer-readable storage medium storing executable instructions for implementing the firewall configuration method provided in this application when executed by a processor.

[0048] This application embodiment receives a firewall configuration request for a target cloud network service, the firewall configuration request carrying the identifier of the target resource pool corresponding to the target cloud network service; based on the identifier of the target resource pool, it obtains a target network configuration session corresponding to the target resource pool; constructs a first packet in the target network configuration session, the first packet carrying firewall configuration parameters; and sends the first packet to the target firewall corresponding to the target resource pool through the target network configuration session, so that the target firewall performs parameter configuration based on the firewall configuration parameters. This allows for direct acquisition of a pre-built network configuration session when firewall configuration is required, and the distribution of firewall configuration parameters to the target firewall through this network configuration session, thereby completing the firewall configuration efficiently. Attached Figure Description

[0049] Figure 1 This is an optional architecture diagram of the firewall configuration system 100 provided in this application embodiment;

[0050] Figure 2 This is an optional structural schematic diagram of the electronic device provided in an embodiment of this application;

[0051] Figure 3 This is an optional flowchart illustrating the firewall configuration method provided in this application embodiment;

[0052] Figure 4 This is an optional structural diagram of the firewall configuration system provided in the embodiments of this application;

[0053] Figure 5 This is an optional detailed flowchart of step 302 provided in an embodiment of this application;

[0054] Figure 6 This is an optional flowchart illustrating the network configuration method provided in an embodiment of this application. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0056] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0057] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0058] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0059] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0060] 1) NETCONF is a configuration protocol based on Extensible Markup Language (XML). After establishing a NETCONF session between the controller and the switching device, the controller sends NETCONF messages to the switching device to configure the network. This simplifies the configuration operations for network administrators and enables more flexible and convenient network configuration.

[0061] 2) Firewall technology is a technology that combines various software and hardware devices used for security management and screening to help computer networks build a relatively isolated protective barrier between their internal and external networks in order to protect the security of user data and information.

[0062] The main function of firewall technology is to promptly detect and address potential security risks and data transmission issues that may exist during the operation of a computer network. These measures include isolation and protection, and the firewall can also record and detect various operations within the computer network to ensure the security of the computer network, protect the integrity of user data and information, and provide users with a better and safer computer network experience.

[0063] 3) Cloud network services refer to business platforms provided on demand by the cloud, including operation platforms, communication platforms and architecture platforms.

[0064] This application provides a firewall configuration method, apparatus, electronic device, and computer-readable storage medium, which can improve the efficiency of firewall configuration.

[0065] First, the firewall configuration system provided in the embodiments of this application will be described, see [link to relevant documentation]. Figure 1 , Figure 1 This is an optional architecture diagram of the firewall configuration system 100 provided in this application embodiment. The client 103 connects to the server 101 through the network 102. In some embodiments, the client 103 may be a laptop, tablet, desktop computer, smartphone, dedicated messaging device, portable gaming device, smart speaker, smartwatch, etc., but is not limited to these. The server 101 may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery network (CDN) services, and big data and artificial intelligence platforms. The network 102 may be a wide area network or a local area network, or a combination of both. The client 103 and the server 101 may be connected directly or indirectly through wired or wireless communication, which is not limited in this application embodiment.

[0066] The electronic device for implementing the firewall configuration method described above, as provided in the embodiments of this application, will now be described. See [link to relevant documentation]. Figure 2 , Figure 2 This is an optional structural diagram of the electronic device 200 provided in this application embodiment. In practical applications, the electronic device 200 can be implemented as follows: Figure 1 The client 103 or server 101 in the middle, with electronic devices as Figure 1 Taking the client 103 shown as an example, the electronic device implementing the firewall configuration method of this application embodiment will be described. Figure 2 The illustrated electronic device 200 includes at least one processor 201, a memory 205, at least one network interface 202, and a user interface 203. The various components in the electronic device 200 are coupled together via a bus system 204. It is understood that the bus system 204 is used to implement communication between these components. In addition to a data bus, the bus system 204 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 204.

[0067] Processor 201 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0068] User interface 203 includes one or more output devices 2031 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 203 also includes one or more input devices 2032, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0069] The memory 205 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 205 may optionally include one or more storage devices physically located away from the processor 201.

[0070] The memory 205 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 205 described in this application embodiment is intended to include any suitable type of memory.

[0071] In some embodiments, the memory 205 can store data to support various operations. Examples of such data include programs, modules, and data structures, or subsets or supersets thereof. In this embodiment, the memory 205 stores an operating system 2051, a network communication module 2052, a presentation module 2053, an input processing module 2054, and a firewall configuration device 2055. Specifically...

[0072] Operating system 2051 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, and driver layer, for implementing various basic business functions and handling hardware-based tasks.

[0073] The network communication module 2052 is used to reach other computing devices via one or more (wired or wireless) network interfaces 202, such as Bluetooth, WiFi, and Universal Serial Bus (USB).

[0074] Presentation module 2053 is configured to enable the presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more output devices 2031 (e.g., a display screen, a speaker, etc.) associated with user interface 203;

[0075] The input processing module 2054 is used to detect and translate one or more user inputs or interactions from one or more input devices 2032.

[0076] In some embodiments, the firewall configuration device provided in this application can be implemented in software. Figure 2 A firewall configuration device 2055 stored in memory 205 is shown. This device can be software in the form of programs and plug-ins, and includes the following software modules: a receiving module 20551, an obtaining module 20552, a building module 20553, and a sending module 20554. These modules are logically linked and can therefore be arbitrarily combined or further separated according to the functions they implement. The functions of each module will be described below.

[0077] In other embodiments, the firewall configuration device provided in this application can be implemented in hardware. As an example, the firewall configuration device provided in this application can be a processor in the form of a hardware decoding processor, which is programmed to execute the firewall configuration method provided in this application. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0078] The firewall configuration method provided in this application will be described in conjunction with exemplary applications and implementations of the client provided in the embodiments of this application.

[0079] See Figure 3 , Figure 3 This is an optional flowchart illustrating the firewall configuration method provided in this application embodiment, which will be combined with... Figure 3 The steps shown are explained.

[0080] Step 301: Receive a firewall configuration request for the target cloud network service, wherein the firewall configuration request carries the identifier of the target resource pool corresponding to the target cloud network service;

[0081] Step 302: Based on the identifier of the target resource pool, obtain the target network configuration session corresponding to the target resource pool;

[0082] Step 303: Construct a first packet in the target network configuration session, the first packet carrying firewall configuration parameters;

[0083] Step 304: Through the target network configuration session, the first packet is sent to the target firewall corresponding to the target resource pool, so that the target firewall can configure parameters based on the firewall configuration parameters.

[0084] It should be noted that, see Figure 4 , Figure 4 This is an optional structural diagram of the firewall configuration system provided in this application embodiment. In this application embodiment, the firewall configuration system includes a device management module, a session pool module, a packet encapsulation module, a packet sending module, a packet parsing module, an anomaly alarm module, and a log recording module. Among them,

[0085] Device Management Module: This module allows network configuration personnel to pre-enter basic information about firewall devices, including the resource pool number, region number, firewall device IP address, connection port, login username, password, and connection protocol. This entered basic information is then provided to the Session Pool Module.

[0086] Session Pool Module: The system server is a NETCONF client, and the firewall device is a NETCONF server. When the system starts, it obtains the basic firewall information from the device management module. Based on the IP address of the destination firewall, the SSH authentication username and password, and the core session count of each resource pool set in the session pool, it establishes a NETCONF session with the destination firewall for the core session count. It receives call requests from the cloud network service platform side and schedules the distribution of idle NETCONF sessions in the corresponding resource pool in the service.

[0087] Message encapsulation module: NETCONF protocol messages are encoded in XML format. Based on the order information transmitted by the platform-side call interface, the message encapsulation module constructs messages for interaction between the NETCONF client and the server. It converts Java entity classes into XML format messages through the native JAXB marshalling function and provides them to the message sending module.

[0088] Message sending module: Based on the XML format message constructed by the message encapsulation module, the message is written to the output stream in the NETCONF session. The RPC mechanism in the message remotely requests the NETCONF server to issue the cloud network service firewall configuration. The NETCONF server correctly executes the operation on the current firewall according to the received message content.

[0089] The message parsing module: The NETCONF server integrates the results of the message sending module's operations on the device, and writes NETCONF messages in XML format, sending them back to the NETCONF client. The message parsing module uses native JAXB unmarshalling functionality to convert the returned XML messages into Java objects. The message parsing module then... <rpc-reply>The response content in the element determines whether the configuration was successfully sent, and also retrieves the message returned. <data>data.

[0090] Anomaly alarm module: The message parsing module parses out... <rpc-error>If the element is detected, it indicates that an error occurred in the transmission of this message, and the information is retrieved. <rpc-error>The error message recorded in the element allows the exception alarm module to distinguish the error type based on the error message and issue an exception alarm.

[0091] The logging module records XML-formatted request and response messages between the NETCONF client and server. Each request and response message is recorded separately. When the exception alarm module issues an alarm, it retrieves the request and response messages from the logging module and investigates the cause of the configuration error by checking the error message and request parameters.

[0092] It should be noted that the firewall configuration system involved in this application embodiment is set within the client provided in this application embodiment. In actual implementation, when the cloud network service platform sends a firewall configuration request to the network configuration device (i.e., the client), the network configuration device responds to the request, obtains the identifier of the target resource pool corresponding to the target cloud network service carried in the request, and obtains the target network configuration session corresponding to the target resource pool based on the identifier of the target resource pool.

[0093] In some embodiments, see Figure 5 , Figure 5 This is an optional detailed flowchart of step 302 provided in the embodiment of this application. Step 302 can also be implemented in the following ways:

[0094] Step 501: Obtain the correspondence between the resource pool identifier and the session pool;

[0095] Step 502: Based on the correspondence and the identifier of the target resource pool, obtain the session pool corresponding to the target resource pool;

[0096] Step 503: Determine the network configuration sessions that are in an idle state from the session pool corresponding to the target resource pool;

[0097] Step 504: Determine the target network configuration session from the determined network configuration sessions.

[0098] In practice, the terminal obtains the identifier of the firewall resource pool and the corresponding session pool. This correspondence can be stored in the form of a table. In step 502, the terminal obtains the session pool corresponding to the target resource pool based on this correspondence and the identifier of the target resource pool.

[0099] In some embodiments, step 503 can also be implemented by: obtaining the status information of each network configuration session in the session pool; and determining the network configuration sessions in the session pool that are in an idle state based on the status information of each network configuration session.

[0100] In some embodiments, the following can also be performed: updating the state information of the target network configuration session to a non-idle state.

[0101] In some embodiments, before step 301, the following steps may be performed: constructing session pools for at least two resource pools, each resource pool corresponding to a cloud network service; obtaining the identifier of each resource pool in the at least two resource pools; and constructing a correspondence between the identifier of the resource pool and the corresponding session pool based on the identifier of each resource pool in the at least two resource pools and the corresponding session pool.

[0102] In some embodiments, the construction of a session pool for at least two resource pools can also be achieved by: obtaining the performance parameters of the network configuration device; and constructing a session pool for at least two resource pools based on the performance parameters and the number of resource pools for the at least two resource pools.

[0103] In some embodiments, the construction of a session pool for at least two resource pools based on the performance parameters and the number of resource pools of the at least two resource pools can also be implemented in the following manner: determining the number of network configuration sessions corresponding to each resource pool based on the performance parameters and the number of resource pools of the at least two resource pools; constructing a session pool for at least two resource pools based on the number of sessions; wherein the number of network configuration sessions contained in each session pool is the number of sessions.

[0104] In some embodiments, the following steps may also be performed: obtaining the number of network configuration sessions in the target resource pool that are in an idle state; creating a new network resource configuration session when the number of network configuration sessions in the idle state is less than or equal to a number threshold; and adding the created network resource configuration session to the target resource pool.

[0105] In some embodiments, before constructing the first packet in the target network configuration session, the following can also be performed: constructing a second packet in the target network configuration session, the second packet carrying the initial configuration parameters of the target firewall; sending the second packet to the target firewall through the target network configuration session; wherein, the second packet is used by the target firewall to perform data rollback based on the second packet when an anomaly occurs in parameter configuration based on the first packet, so as to roll back the configuration parameters of the target firewall to the initial configuration parameters.

[0106] This application embodiment receives a firewall configuration request for a target cloud network service, the firewall configuration request carrying the identifier of the target resource pool corresponding to the target cloud network service; based on the identifier of the target resource pool, it obtains a target network configuration session corresponding to the target resource pool; constructs a first packet in the target network configuration session, the first packet carrying firewall configuration parameters; and sends the first packet to the target firewall corresponding to the target resource pool through the target network configuration session, so that the target firewall performs parameter configuration based on the firewall configuration parameters. This allows for direct acquisition of a pre-built network configuration session when firewall configuration is required, and the distribution of firewall configuration parameters to the target firewall through this network configuration session, thereby completing the firewall configuration efficiently.

[0107] The following will describe an exemplary application of the embodiments of this application in a real-world application scenario. See also... Figure 6 , Figure 6 This is an optional flowchart illustrating the network configuration method provided in an embodiment of this application.

[0108] Step 1: Before the resource pool goes online, network configuration personnel obtain the target firewall's IP address, connection port, SSH authentication username and password, and record them in the device configuration module of this system.

[0109] Step 2: Based on the information in the device configuration module, construct the NETCONF session pool. The specific steps are as follows:

[0110] Step 2.1: First, calculate the number of core sessions required for each resource pool using the following formula:

[0111]

[0112] Where, n session n represents the number of core sessions in each resource pool. cpu p represents the number of CPUs on the server where this system is located. cpu This represents the expected CPU utilization of the server hosting this system, t. wait t represents the waiting time for the task. work n represents the execution time of the task. resource Indicates the number of resource pools;

[0113] Step 2.2: Initialize the session instance list, based on n resource Initialize the list of core session instances s in the resource pool core Set the maximum number of sessions n max Set the list of session instances in the resource pool to equal the list of core session instances in the resource pool. ture =s core At this time, the status flag 'e' of the session instance is 0 (0 represents that the status flag is idle, and 1 represents that the status flag is in use).

[0114] Step 2.3: When the number of session instances in the resource pool is less than the number of core session instances in the resource pool (s) core When the size is small, the actual number of session instances is still s. core The size. When the number of session instances in the resource pool is greater than the core session instance list s of the resource pool. core When calculating the number of session instances, the actual formula for calculating the list is as follows:

[0115] s ture =s core +s dynamic ,

[0116] Among them, s dynamic This represents the list of dynamically created session instances when no idle core session instances are available, and s true The size does not exceed n max .

[0117] Step 2.4: Construct a dictionary to obtain idle session instances, indexing the session instances using key-value pairs, where the dictionary key is the resource pool number p. i The key value is the list of session instances for the corresponding resource pool. By using the status flag 'e' of the session instance, the currently idle sessions in the resource pool can be obtained.

[0118] Step 3: Receive the request from the cloud network service platform and obtain an idle session from the session pool according to the resource pool number of the current service.

[0119] Step 4: Build a packet that saves the current firewall configuration in the NETCONF session, send it to the destination firewall, and record the firewall configuration in the CFG file;

[0120] Step 5: Based on cloud network services, construct and configure firewall VPN, sub-interface, static route, NAT policy, security domain policy and other packets using native JAXB;

[0121] Step 6: Send the configuration messages related to cloud network services to the target firewall device;

[0122] Step 7: Parse the XML message of the destination firewall device configuration operation completion response, such as parsing out... <ok>If the element is successfully parsed, it indicates that the delivery was successful. <rpc-error>If an element is not found, it is determined that there is an error in this configuration distribution. The error message is captured and an alarm is issued. The XML messages of the request and response are stored in the database.

[0123] Step 8: If an error occurs during the distribution of numerous configurations for the cloud network service firewall, obtain the filename of the pre-saved firewall CFG configuration file, construct a firewall configuration rollback message, and distribute it to the target firewall to roll back the firewall configuration to the state before this platform-side request.

[0124] This application embodiment reduces the resource consumption caused by creating a session for each cloud network service by scheduling sessions through the NETCONF session pool, and greatly shortens the time for automated firewall configuration. In addition, during the process of sending many packets in a single request, it supports anomaly detection and alarm, and can promptly roll back to the firewall state before the current request if an anomaly occurs, so that there will be no anomalies or redundant data.

[0125] The following description continues to illustrate the exemplary structure of the firewall configuration device 255 provided in the embodiments of this application as a software module. In some embodiments, such as Figure 2 As shown, the software modules stored in the firewall configuration device 255 in the memory 250 may include:

[0126] The receiving module 2551 is used to receive a firewall configuration request for a target cloud network service, wherein the firewall configuration request carries the identifier of the target resource pool corresponding to the target cloud network service.

[0127] The module 2552 is used to obtain the target network configuration session corresponding to the target resource pool based on the identifier of the target resource pool;

[0128] Module 2553 is used to construct a first packet in the target network configuration session, the first packet carrying firewall configuration parameters;

[0129] The sending module 2554 is used to send the first message to the target firewall corresponding to the target resource pool through the target network configuration session, so that the target firewall can perform parameter configuration based on the firewall configuration parameters.

[0130] In some embodiments, obtaining the target network configuration session corresponding to the target resource pool based on the identifier of the target resource pool includes: obtaining the correspondence between the identifier of the resource pool and the session pool; obtaining the session pool corresponding to the target resource pool based on the correspondence and the identifier of the target resource pool; determining the network configuration sessions in an idle state from the session pool corresponding to the target resource pool; and determining the target network configuration session from the determined network configuration sessions.

[0131] In some embodiments, determining the network configuration sessions in an idle state from the session pool corresponding to the target resource pool includes: obtaining the status information of each network configuration session in the session pool; and determining the network configuration sessions in an idle state in the session pool based on the status information of each network configuration session.

[0132] In some embodiments, the method further includes updating the state information of the target network configuration session to a non-idle state.

[0133] In some embodiments, before receiving the firewall configuration request for the target cloud network service, the method further includes: constructing session pools for at least two resource pools, each resource pool corresponding to a cloud network service; obtaining the identifier of each resource pool in the at least two resource pools; and constructing a correspondence between the identifier of the resource pool and the corresponding session pool based on the identifier of each resource pool in the at least two resource pools and the corresponding session pool.

[0134] In some embodiments, constructing a session pool for at least two resource pools includes: obtaining performance parameters of the network configuration device; and constructing a session pool for at least two resource pools based on the performance parameters and the number of resource pools for the at least two resource pools.

[0135] In some embodiments, constructing a session pool for at least two resource pools based on the performance parameters and the number of resource pools of the at least two resource pools includes: determining the number of network configuration sessions corresponding to each resource pool based on the performance parameters and the number of resource pools of the at least two resource pools; and constructing a session pool for at least two resource pools based on the number of sessions; wherein the number of network configuration sessions contained in each session pool is the number of sessions.

[0136] In some embodiments, the method further includes: obtaining the number of network configuration sessions in the target resource pool that are in an idle state; creating a new network resource configuration session when the number of network configuration sessions in the idle state is less than or equal to a number threshold; and adding the created network resource configuration session to the target resource pool.

[0137] In some embodiments, before constructing the first packet in the target network configuration session, the method further includes: constructing a second packet in the target network configuration session, the second packet carrying the initial configuration parameters of the target firewall; sending the second packet to the target firewall through the target network configuration session; wherein the second packet is used by the target firewall to perform data rollback based on the second packet when an anomaly occurs in parameter configuration based on the first packet, so as to roll back the configuration parameters of the target firewall to the initial configuration parameters.

[0138] This application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method described in this application.

[0139] This application provides a computer-readable storage medium storing executable instructions, wherein the executable instructions are stored and when executed by a processor, they will cause the processor to execute the firewall configuration method provided in this application.

[0140] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0141] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0142] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0143] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0144] In summary, the embodiments of this application can improve the efficiency of firewall configuration.

[0145] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application. < / ok> < / data>

Claims

1. A firewall configuration method, characterized in that, Applied to network configuration devices, including: Receive a firewall configuration request for a target cloud network service, wherein the firewall configuration request carries the identifier of the target resource pool corresponding to the target cloud network service; the target cloud network service refers to a service platform provided on demand by the cloud. Obtain the mapping between resource pool identifiers and session pools; Based on the correspondence and the identifier of the target resource pool, the session pool corresponding to the target resource pool is obtained; Idle network configuration sessions are determined from the session pool corresponding to the target resource pool, and a target network configuration session is determined from the determined network configuration sessions; the target network configuration session is determined from a pre-built session pool corresponding to the target resource pool. A first packet is constructed in the target network configuration session, the first packet carrying firewall configuration parameters; The first message is sent to the target firewall corresponding to the target resource pool through the target network configuration session, so that the target firewall can perform parameter configuration based on the firewall configuration parameters.

2. The firewall configuration method according to claim 1, characterized in that, The step of determining an idle network configuration session from the session pool corresponding to the target resource pool includes: Obtain the status information of each network configuration session in the session pool; Based on the status information of each network configuration session, determine the network configuration sessions in the session pool that are in an idle state.

3. The firewall configuration method according to claim 2, characterized in that, The method further includes: Update the status information of the target network configuration session to non-idle state.

4. The firewall configuration method according to claim 1, characterized in that, Before receiving the firewall configuration request for the target cloud network service, the method further includes: Construct session pools for at least two resource pools, with each resource pool corresponding to a cloud network service; Obtain the identifier of each of the at least two resource pools; Based on the identifier of each resource pool in the at least two resource pools and the corresponding session pool, a correspondence between the identifier of the resource pool and the session pool is constructed.

5. The firewall configuration method according to claim 4, characterized in that, The construction of a session pool targeting at least two resource pools includes: Obtain the performance parameters of the network configuration device; Based on the performance parameters and the number of resource pools of the at least two resource pools, a session pool is constructed for the at least two resource pools.

6. The firewall configuration method according to claim 5, characterized in that, The step of constructing a session pool for at least two resource pools based on the performance parameters and the number of resource pools for at least two resource pools includes: Based on the performance parameters and the number of resource pools of the at least two resource pools, determine the number of network configuration sessions corresponding to each resource pool; Based on the number of sessions, construct a session pool for at least two resource pools; The number of network configuration sessions contained in each session pool is the number of sessions.

7. The firewall configuration method according to claim 1, characterized in that, The method further includes: Obtain the number of network configuration sessions that are idle in the target resource pool; When the number of idle network configuration sessions is less than or equal to the number threshold, create a new network resource configuration session. Add the created network resource configuration session to the target resource pool.

8. The firewall configuration method according to claim 1, characterized in that, Before constructing the first packet in the target network configuration session, the method further includes: A second message is constructed in the target network configuration session, the second message carrying the initial configuration parameters of the target firewall; The second message is sent to the target firewall through the target network configuration session; The second message is used by the target firewall to perform data rollback based on the second message when an anomaly occurs in parameter configuration based on the first message, so as to roll back the configuration parameters of the target firewall to the initial configuration parameters.

9. A firewall configuration device, characterized in that, include: The receiving module is used to receive firewall configuration requests for a target cloud network service. The firewall configuration request carries the identifier of the target resource pool corresponding to the target cloud network service. The target cloud network service refers to a service platform provided on demand by the cloud. The acquisition module is used to acquire the correspondence between the identifier of the resource pool and the session pool; based on the correspondence and the identifier of the target resource pool, the session pool corresponding to the target resource pool is acquired; Idle network configuration sessions are determined from the session pool corresponding to the target resource pool, and a target network configuration session is determined from the determined network configuration sessions; the target network configuration session is determined from a pre-built session pool corresponding to the target resource pool. The building module is used to build a first packet in the target network configuration session, the first packet carrying firewall configuration parameters; The sending module is used to send the first message to the target firewall corresponding to the target resource pool through the target network configuration session, so that the target firewall can perform parameter configuration based on the firewall configuration parameters.

10. An electronic device, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the firewall configuration method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, It stores executable instructions for implementing the firewall configuration method according to any one of claims 1 to 8 when executed by a processor.

Images