Change impact simulation analysis

Abstract

A system (100) for simulating network configurations includes data processing hardware (204) and memory hardware (206) in communication with the data processing hardware (204). The memory hardware (206) stores instructions that, when executed by the data processing hardware (204), cause the data processing hardware (204) to perform operations. The operations include receiving one or more parameter changes (84) to a production network model (354) of a network (200). The operations also include generating a simulated network model (356) that includes the one or more parameter changes (84). Another operation includes analyzing simulated network flows (362) within the simulated network model (356). The operations also include generating a report (332). The operations can also include simulating a production network log (322) of a production workflow within the simulated network model (356) to generate a simulated network log (366).

Description

Technical Field

[0001] This disclosure relates to simulation analysis of the impact of changes in cloud networks. Background Technology

[0002] A Virtual Private Cloud (VPC) is an on-demand, configurable pool of shared computing resources allocated within a public cloud environment. A VPC provides isolation to users from other cloud users. A VPC can run one or more virtual machines (VMs), which can communicate with the user's local network or other remote resources via a Virtual Private Network (VPN). Due to the potential size and complexity of VPCs (which can include any number of VMs, network gateways, load balancers, etc.), significant network configuration is typically required to operate and maintain them. Summary of the Invention

[0003] One aspect of this disclosure provides a method for simulating network changes. The method includes receiving one or more parameter changes of a production network model of the network at data processing hardware. The method also includes generating a simulated network model including the one or more parameter changes via the data processing hardware. Additionally, the method includes analyzing simulated network flows within the simulated network model via the data processing hardware and generating a report including the impact of the parameter changes on the network via the data processing hardware.

[0004] This aspect of the disclosure may include one or more of the following optional features. In some examples, the method further includes receiving production network logs, including a recording workflow of a production network model, at data processing hardware, and simulating the production workflow of the production network logs within a simulated network model using the data processing hardware to generate simulated network logs. In some examples, analyzing the simulated network flow includes comparing the production network logs with the simulated network logs using the data processing hardware, and identifying differences between the production network logs and the simulated network logs using the data processing hardware. Optionally, the production network logs are one of a virtual private connection flow log and a firewall rule log.

[0005] In some examples, the method may include determining the impact of the proposed parameter change on a production network model via data processing hardware. Here, the method may include determining the impact of the proposed parameter change on at least one of network reachability, firewall hit rate predicted by firewall shadow rules, user intent rules, security compliance rules, and resource quotas and utilization.

[0006] In some configurations, generating a simulated network model involves incrementally incorporating one or more proposed parameter changes into the production network model via data processing hardware. In some examples, the method includes receiving one or more invariant parameters of the production network via data processing hardware. The method may also include changing the network configuration via data processing hardware when the impact of the parameter changes on the network is acceptable.

[0007] Another aspect of this disclosure provides a system. The system includes data processing hardware and memory hardware in communication with the data processing hardware. The memory hardware stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform operations. These operations include receiving one or more parameter changes from a production network model of a network. These operations also include generating a simulated network model including the one or more parameter changes. Another operation includes analyzing simulated network flows within the simulated network model. These operations also include generating a report including the impact of the parameter changes on the network.

[0008] This aspect of the disclosure may include one or more of the following optional features. In one example, the operation includes receiving production network logs that include a recording workflow of a production network model. Another operation includes simulating the production workflow of the production network logs within a simulated network model to generate simulated network logs. Here, analyzing the simulated network flow may include comparing the production network logs with the simulated network logs and identifying differences between the production network logs and the simulated network logs. Optionally, the production network logs are one of a virtual private connection flow log and a firewall rule log.

[0009] In some configurations, the operation also includes determining the impact of the proposed parameter changes on the production network model. Here, determining the impact of the proposed parameter changes includes determining the impact on at least one of network reachability, firewall hit rate predicted by firewall shadow rules, user intent rules, security compliance rules, and resource quotas and utilization.

[0010] In some examples, generating a simulated network model involves incrementally incorporating one or more proposed parameter changes into the production network model via data processing hardware. In some implementations, the operation includes receiving one or more invariant parameters of the production network via data processing hardware. In some configurations, the operation includes changing the network configuration when the impact of parameter changes on the network is acceptable.

[0011] Another aspect of this disclosure provides a computer program product encoded on a non-transitory computer-readable storage medium, including instructions that, when executed by a data processing apparatus, cause the data processing apparatus to perform operations. These operations include receiving one or more parameter changes of a production network model of a network. Another operation includes generating a simulated network model including one or more parameter changes. These operations also include receiving one or more parameter changes of a production network model of a network. These operations further include generating a simulated network model including one or more parameter changes. Another operation includes analyzing simulated network flows within the simulated network model. These operations also include generating a report including the impact of the parameter changes on the network.

[0012] This aspect of the disclosure may include one or more of the following optional features. In one example, operation includes receiving production network logs that include a recording workflow of a production network model. Another operation includes simulating the production workflow of the production network logs within a simulated network model to generate simulated network logs. Here, analyzing the simulated network flow may include comparing the production network logs with the simulated network logs and identifying differences between the production network logs and the simulated network logs. Optionally, the production network logs are one of a virtual private connection flow log and a firewall rule log.

[0013] In some configurations, the operation also includes determining the impact of the proposed parameter changes on the production network model. Here, determining the impact of the proposed parameter changes includes determining the impact on at least one of network reachability, firewall hit rate predicted by firewall shadow rules, user intent rules, security compliance rules, and resource quotas and utilization.

[0014] In some examples, generating a simulated network model involves incrementally incorporating one or more proposed parameter changes into the production network model via data processing hardware. In some implementations, the operation includes receiving one or more invariant parameters of the production network via data processing hardware. In some configurations, the operation includes changing the network configuration when the impact of parameter changes on the network is acceptable.

[0015] Details of one or more embodiments of this disclosure are set forth in the accompanying drawings and the description below. Other aspects, features, and advantages will become apparent from the description, the drawings, and the claims. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of an example system used to perform simulation analysis of the effects of change in a cloud network.

[0017] Figure 2 yes Figure 1 A schematic diagram of example components of the system's virtual machine.

[0018] Figure 3It is for use Figure 1 A flowchart of an example workflow for network-related changes in the system simulator.

[0019] Figure 4 This is a flowchart of an exemplary arrangement for performing operations that alter the methods used in simulation analysis.

[0020] Figure 5 This is a schematic diagram of an example computing device that can be used to implement the systems and methods described in this paper.

[0021] The same reference numerals in the various figures indicate the same elements. Detailed Implementation

[0022] A Virtual Private Cloud (VPC) is an on-demand, configurable pool of shared computing resources allocated within a public cloud environment to provide isolation between users and other cloud users. This isolation can occur through the allocation of a private Internet Protocol (IP) subnet and / or virtual communication infrastructure. A VPC can run one or more virtual machines (VMs) that can communicate with the user's local network or other remote resources via a Virtual Private Network (VPN) to ensure secure access to the VPC environment. Because some VPC environments are very complex and large-scale (i.e., including a large number of VMs, network gateways, load balancers, etc.), significant network configuration is typically required to operate and maintain the VPC.

[0023] The implementation described herein relates to a network change simulator that allows a user to specify one or more changes to network parameters (e.g., firewall rules, VPC peering, providing or de-providing network resources, etc.) and simulate at least one production workflow through a VPC. The network change simulator provides configuration information for each simulated path, including, for example, routing and firewall rules.

[0024] Here, the network change simulator builds a simulated network model by incrementally incorporating proposed parameter changes into the VPC's production network model. The simulator then simulates a logging workflow from the VPC within the simulated network model, compares the results of the simulated workflow with the production workflow, and generates outputs (e.g., reports) indicating the impact or effect of the proposed configuration, events, and / or network changes on the VPC. VPC users or administrators can use the outputs to decide whether to continue incorporating the proposed parameter changes based on the acceptability of their impact on the VPC.

[0025] refer to Figure 1In some implementations, example system 10 includes user equipment 20 associated with a corresponding user 12 and communicating with cloud network 200 via network 30 (e.g., the Internet) and local network 40 (i.e., the local network that user equipment 20 uses to connect to network 30). Local network 40 includes network gateway 42 (e.g., router) that acts as a forwarding host for local network 40. User equipment 20 may correspond to any computing device, such as a desktop workstation, laptop workstation, or mobile device (e.g., smartphone or tablet). User equipment 20 includes computing resources 22 (e.g., data processing hardware) and / or storage resources 24 (e.g., memory hardware).

[0026] Cloud network 200 can be a single computer, multiple computers, or a distributed system (e.g., a cloud environment) with scalable / elastic resources 202, including computing resources 204 (e.g., data processing hardware) and / or storage resources 206 (e.g., memory hardware). Data storage (i.e., remote storage devices) can overlay storage resources 206 to allow scalable use of storage resources 206 by clients or one or more of computing resources 204. Cloud network 200 is configured to implement and execute one or more virtual machines (VMs) 250, 250a-n. One or more VMs execute securely in a Virtual Private Cloud (VPC) environment or VPC 208 associated with or operated by user 12. VPC 208 may include various other network elements, such as load balancers, gateways, front-ends, and back-ends.

[0027] exist Figure 2 In the example shown, the distributed system 200 includes a collection 210 of resources 110 (e.g., hardware resources 110h), a virtual machine monitor (VMM) 220, a VM layer 240 executing one or more VMs 250, and an application layer 260. Each hardware resource 110h may include one or more physical central processing units (pCPUs) 204 (“physical processors 204”) and memory hardware 206. Although each hardware resource 110h is shown as having a single physical processor 204, any hardware resource 110h may include multiple physical processors 204. An operating system 212 may execute on the collection 210 of resources 110.

[0028] In some examples, VMM 220 corresponds to hypervisor 220 (e.g., a compute engine), which includes at least one of software, firmware, or hardware configured to create and execute VMs 250. The computer (i.e., data processing hardware 204) associated with the VMM 220 executing one or more VMs 250 may be referred to as a host, and each VM 250 may be referred to as a guest machine. Here, the VMM 220 or hypervisor is configured to provide each VM 250 with a corresponding guest operating system (OS) 212g having a virtual operating platform and to manage the execution of the corresponding guest OS 212g on the VM 250. As used herein, each VM 250 may be referred to as an "instance" or "VM instance." In some examples, multiple instances of various operating systems may share virtualization resources. For example, The first VM 250 operating system The second VM 250 and operating system The third VM 250 operating system can all run on a single physical x86 machine.

[0029] VM layer 240 includes one or more virtual machines 250. Distributed system 200 enables user 12 to launch VMs 250 on demand. VMs 250 emulate real computer systems and operate based on the computer architecture and functionality of real or hypothetical computer systems, which may involve specialized hardware, software, or a combination thereof. In some examples, distributed system 200 authorizes and authenticates user 12 before launching one or more VMs 250. An instance of software, or simply an instance, refers to a VM 250 hosted on (and running on) the data processing hardware 204 of distributed system 200.

[0030] Each VM 250 may include one or more virtual central processing units (vCPUs) 252 (“virtual processors”). In the example shown, a first virtual machine 250a includes a first group 252a of one or more virtual processors 252, and a second virtual machine 250b includes a second group 252b of one or more virtual processors 252. Although the second group 252b is shown as including only one virtual processor 252, any number of virtual processors 252 is possible. Each virtual processor 252 emulates one or more physical processors 204. For example, a first group 252a of one or more virtual processors 252 emulates a first group 204a of one or more physical processors 204, and a second group 252b of one or more virtual processors 252 emulates a second group 204b of one or more physical processors 204. The application layer 260 includes software resources 110s, 110sa, 110sb (software applications) that can be executed on the virtual machines 250.

[0031] Typically, each software instance (e.g., virtual machine 250) includes at least one virtual storage device 262 that provides volatile and non-volatile storage capacity for services on physical storage hardware 206. For example, the storage capacity on physical storage hardware 206 may include: a persistent disk (PD) that stores data for user 12 across several physical disks (e.g., memory region 620 (FIG. 9)) of storage hardware 206; or random access memory (RAM) to provide volatile storage. More specifically, each virtual storage device 262 of the corresponding VM 250 moves data in sequences (blocks) of bytes or bits to an associated physical block storage volume V on storage hardware 206 to provide non-volatile storage. Thus, the virtual storage device 262 of the corresponding VM instance 250 provides storage capacity mapped to the corresponding physical block storage volume V on storage hardware 206. In some examples, the virtual storage device 262 supports random access to data on storage hardware 206 and typically uses buffered I / O. Examples include hard disks, CD-ROM drives, and flash drives. Similarly, portions of the volatile memory (e.g., RAM) of the physical memory hardware 206 can be partitioned across the virtual memory device 262.

[0032] A guest kernel 214g resides within the guest operating system 212g. The kernel is a computer program that forms the core of the operating system, possessing complete access to and control over the OS. In other words, the kernel acts as an intermediary between the application 110s and the host's hardware resources 110h. Most modern computing systems separate virtual memory into a protected kernel space and a user space 216g. The kernel typically resides in volatile memory within the protected kernel space and is isolated from the user space 216g. For enhanced security and reliability, the application 110s and other software services typically execute in the guest user space 216g and lack the privileges necessary to interact with the protected kernel space.

[0033] Continue to refer to Figure 1 The cloud network 200 can also execute the VPC Intelligent System 300, which provides different modules for monitoring and managing VPC 208. For example... Figure 1As generally shown, the network simulation system 300 includes: a network monitor 310 configured to monitor the health, security, and operation of VPC 208; a network logger 320 configured to log traffic flows and firewall events within VPC 208; and a network change simulator 330 operable to identify the impact of a proposed change 84 on network parameters 82 of VPC 208. The network change simulator 330 analyzes whether a proposed change 80 to one or more network parameters 82 of cloud network 200 will affect the performance of cloud network 200. Using this analysis, user 12 can then decide whether to accept, reject, or modify the proposed change 84 before actually implementing it in cloud network 200.

[0034] Network monitor 310 can be integrated into change analysis system 304 or as a standalone module of network simulation system 300. Network monitor 310 is operable to assess the overall health of VPC 208. For example, network monitor 310 can perform configuration checks, identify network failures and disconnected connections, monitor resource utilization and quotas within VPC 208, perform IP address overlap checks within VPC 208, and / or identify resource capacity reductions due to poor network health. Network monitor 310 can also monitor firewall rules and firewall hits of VPC 208 to identify potential security issues related to VPC 208. Network monitor 310 can also be configured to monitor VPC 208 to identify whether VPC 208 components (such as subnets, firewalls, and load balancers) are underutilized. When included, network monitor 310 can be configured to generate an automatic change request 80b, including recommendations for parameter changes 84, based on monitoring of VPC 208.

[0035] The network change simulator 330 receives or obtains change requests 80, 80a, and 80b, which include proposed changes 84 to network parameters 82 of the cloud network 200. Examples of network parameters 82 that can be changed include (i) adding or removing firewall rules, (ii) adding or removing VPC peering, (iii) adding or removing IP address blocks, VMs 250, subnets, and / or load balancers, and / or (iv) adding or removing VPN tunnels, BB masks, Zakim endpoints, etc. The network change simulator 330 can receive or obtain change requests 80 and 80a, including parameter changes 84, directly from user 12 via user device 20. Additionally or alternatively, the network change simulator 330 can receive or obtain change requests 80 and 80b that include parameter changes 84 recommended by the network monitor 310 of the network simulation system 300. In addition to change request 80, the network change simulator 330 also receives or retrieves one or more invariant parameters 86 from the network monitor 310. Invariant parameter 86 may include security compliance rules specified by the administrator or service provider of cloud network 200 or by user 12. Invariant parameter 86 includes network parameters that cannot be modified by changing request 80.

[0036] In addition to obtaining the change request 80 and the invariant parameter 86, the network change simulator 330 also retrieves one or more network logs 322 associated with the current or previous configuration of the cloud network 200 (which may be referred to as the production configuration). The network logs 322 may include VPC flow logs 322, 322a and / or firewall logs 322, 322b. The VPC flow logs 322a include records of sample network flows sent from and received by each VM 250, while the firewall logs 322b include connection records for each instance corresponding to specific firewall rules that allow or deny traffic. The connection records in the firewall logs 322b contain source and destination IP addresses, protocols and ports, dates and times, and references to specific firewall rules applied to the allowed or denied traffic.

[0037] The network change simulator 330 includes a simulation workflow engine 340 that monitors and manages the activities of the network change simulator 330. The simulation workflow engine 340 sends and receives simulation information within the network simulation system 300 and the cloud environment 200. The simulation workflow engine 340 also assigns simulation tasks to other modules 350, 360, and 370 of the network change simulator 330, as discussed in the following paragraphs. For example, the simulation workflow engine 340 may receive a change request 80 from user device 20 or network monitor 310, and then manage operations within the network change simulator 330 to determine and report the potential impact of the change request 80.

[0038] One of the modules 350 of the network change simulator 330 includes a network modeler 350 operable to generate a simulated network model 356 based on one of the change requests 80. The network modeler 350 begins with a production network model 354 representing the current production configuration of VPC 208. The network modeler 350 then generates the simulated network model 356 by incrementally incorporating parameter changes 84 specified in the change request 80. Therefore, the simulated network model 356 includes one or more graphs of VPC 208 incorporating the parameter changes 84.

[0039] Another module of the network change simulator 330 includes a log replayer 360, which performs simulated network flow 362 within the simulated network model 356 by replaying one of the network logs 322 obtained from the network logger 320. As a reminder, the logs 322 obtained from the network logger include VPC logs 322a and firewall rule logs 322b generated by the network intelligence system 270 for the production configuration of the cloud network 200. Therefore, the model log replayer 360 uses the VPC logs 322a and firewall rule logs 322b to simulate the workflow that will occur within the cloud network 200 based on the simulated network model 356.

[0040] Log replayer 360 analyzes the simulated network model 356 while executing the example workflow provided in network log 322 to determine the impact of change 84 on performance metrics of VPC 208. Log replayer 360 analyzes and reports multiple performance metrics associated with simulated network model 356. For example, log replayer 360 analyzes the impact of parameter change 84 on reachability within VPC 208. Here, log replayer 360 identifies whether the change is opening reachability between previously blocked IP ranges and / or VMs 250, or alternatively, disconnecting reachability between previously open IP ranges and / or VMs 250. Log replayer 360 can interpret the impact on reachability based on reachability intent specified by the user.

[0041] Log Replay 360 also analyzes and reports the impact of parameter change 84 on firewall rule relationships. For example, Log Replay 360 analyzes whether parameter change 84 results in additional or eliminated firewall shadows. Log Replay 360 also identifies whether firewall optimality and / or firewall security boundaries have changed. Regarding firewall optimality, Log Replay 360 analyzes and reports whether the simulated network model 356 includes additional firewall shadow relationships, resulting in a more verbose and less effective firewall for VPC 208, or whether firewall shadow relationships have been eliminated, thus optimizing the firewall. Regarding firewall security boundaries, Log Replay 360 analyzes and reports whether parameter change 84 results in security boundaries being opened or tightened. Log Replay 360 can also analyze and report the predicted firewall hit rate of the simulated network model 356.

[0042] The log replayer 360 can also analyze whether the simulated network model 356 affects the network intent specified by user 12. For example, user 12 may initially specify that the intent of VPC 208 is to perform or support specific business functions (e.g., configure cellular networks, manage product logistics). Here, the network evaluator 360 analyzes whether the changes 84 incorporated into the simulated network model 356 will comply with or violate the intent rules of VPC 208. Similarly, the log replayer 360 analyzes and reports whether the simulated network model 356 affects the network compliance rules of VPC 208. The log replayer 360 stores the results of the simulated workflow on the simulated network model 356 as a simulated log 366.

[0043] Log replayer 360 records the result of replaying production log 322 within simulated network model 356 as simulated log 366 and stores simulated log 366 on change analysis system 304. Simulated workflow engine 340 then compares simulated log 366 with the corresponding production log 322 to identify differences between production network model 354 (i.e., the current VPC network 208) and simulated network model 356 (i.e., VPC network 208 including parameter changes 84).

[0044] In addition to the log replayer 360, which performs dynamic analysis of the simulated network model 356 using the sample workflow provided in network log 322, the change analysis system 304 of the network change simulator 330 may also include a network analyzer 370, which performs static analysis of the simulated network model 356. Here, the network analyzer 370 is configured to perform validation tests on the simulated network model 356 to identify potential problems with the proposed parameter change 84. For example, the network analyzer 370 may perform a comparison of parameter change 84 with production network parameters 82 (e.g., static analysis, configuration checks using invariants, etc.) to highlight the differences between the production network model 354 and the simulated network model 356. In some examples, the network monitor 310 and the network analyzer 370 are integrated within the same module to perform both monitoring and analysis functions.

[0045] Network analyzer 370 is operable to assess the overall health of network simulation model 356. For example, network analyzer 370 can perform configuration checks, identify unused routes and disconnected connections, monitor resource utilization and quotas within network simulation model 356, perform IP address overlap checks within network simulation model 356, and / or identify resource capacity reductions due to poor network health. Network analyzer 370 can also analyze firewall rules and firewall hits of network simulation model 356 to identify potential security issues related to network simulation model 356. Additionally or alternatively, network analyzer 370 can analyze the simulated network model 356 to identify whether components of network simulation model 356 (such as subnets, firewalls, and load balancers) overlap and / or are underutilized.

[0046] Based on the results of dynamic analysis at log replay unit 360 and / or static analysis at network analyzer 370, network change simulator 330 can generate a change impact report 332 and present it to user 12 via user device 20. If parameter change 84 is implemented, change impact report 332 identifies the impact on network reachability, firewall, user intent rules, security compliance rules, and resource quotas and utilization of VPC 208. Upon receiving change impact report 332, user device 20 presents it to user 12 to assess whether the pending parameter change 84 should be accepted, rejected, or modified. Figure 3 As shown and described later, user 12 can use the change impact report 332 to decide whether to accept, reject, or edit the parameter change 84.

[0047] Now for reference Figure 3This provides a sample workflow 400 for user 12, who interfaces with network change simulator 330 via user equipment 20. At block 402, user 12 or network monitor 310 generates a change request 80 including parameter change 84. At block 404, network analyzer 370 analyzes parameter change 84 and generates static analysis impact reports 332, 332a, which identify the impact of parameter change 84 on VPC network 208. Static analysis impact report 332a can identify the impact on network reachability, firewall shadow rules and predicted hit rates, user intent rules, security compliance rules, and resource quotas and utilization.

[0048] The network change simulator 330 provides a static analysis impact report 332a to user equipment 20, where, at decision block 406, user 12 provides instructions regarding whether the impact of the pending parameter change 84 is acceptable to user 12. If the static analysis impact report 332a indicates that parameter change 84 will have no or minimal impact on VPC 208, user 12 can decide that the pending parameter change 84 is acceptable and proceed to block 408 to accept the pending parameter change 84. Conversely, if the static analysis impact report 332a clearly indicates that parameter change 84 will cause VPC 208 to fail, user 12 can respond that the pending parameter change 84 is unacceptable and proceed to decision block 410 to decide whether parameter change 84 should be edited. If user 12 decides not to edit parameter change 84, the workflow proceeds to block 412 and parameter change 84 is rejected.

[0049] When the impact of parameter change 84 is not explicitly acceptable or unacceptable at decision block 406, user 12 can instruct network change simulator 330 to perform log replay at block 414. As described above, log replay 414 is performed on log replayer 360 to generate simulated log 366 by replaying production log 322 within simulated network model 356. The workflow then proceeds to block 416, where simulated log 366 is compared with production log 322 to identify differences between production network model 354 (i.e., current VPC 208) and simulated network model 356 (i.e., proposed VPC 208). Network change simulator 330 then generates a dynamic analysis impact report 332b detailing the differences between production network model 354 and simulated network model 356 based on the differences between production log 322 and simulated log 366.

[0050] At decision block 418, user 12 checks the dynamic analysis impact report 332b to determine whether the difference between the production network model 354 and the simulated network model 356 is acceptable. If the difference is acceptable, the workflow proceeds to block 408 and parameter change 84 is merged into VPC 208. If the difference is unacceptable, the workflow proceeds to decision block 410, where user 12 decides whether to edit parameter change 84. If user 12 does not want to edit parameter change 84 (i.e., the answer at block 410 is "no"), the parameter change is rejected at block 412. However, if user 12 decides to edit parameter change 84, the workflow proceeds to block 420, where user 12 can modify one or more of parameter changes 84. When parameter change 84 is edited at block 420, the workflow returns to block 402 and initiates another change request 80 including the edited parameter change 84. Therefore, workflow 400 repeats until parameter change 84 is accepted at block 408 or rejected at block 412, thus allowing user 12 to iteratively modify, simulate, and review parameter change 84 for VPC 208 without interrupting production of VPC 208.

[0051] Figure 4 This is a flowchart illustrating an exemplary arrangement of operations for performing a method 500 to simulate the impact of changes. Method 500 includes, at operation 502, receiving one or more parameter changes 84 of a production network model 354 of network 208 at data processing hardware 204. At operation 504, method 500 includes generating a simulated network model 356 including the one or more parameter changes 84 via data processing hardware 204. At operation 506, method 500 includes receiving a production network log 322 of the production network model 354 at data processing hardware 204. At operation 508, method 500 includes simulating the execution of the production network log 322 within the simulated network model 356 via data processing hardware 204 to generate a simulated network log 366. Method 500 also includes: at operation 510, analyzing the simulated network log 366 via data processing hardware analysis 204; and at operation 512, generating a network impact report 332 including the impact of the parameter changes 84 on network 208 via data processing hardware.

[0052] Figure 5 This is a schematic diagram of an example computing device 600 that can be used to implement the systems and methods described in this document. The computing device 600 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the ways in which the inventions described and / or claimed in this document can be implemented.

[0053] Computing device 600 includes a processor 610, a memory 620, a storage device 630, a high-speed interface / controller 640 connected to the memory 620 and a high-speed expansion port 650, and a low-speed interface / controller 660 connected to a low-speed bus 670 and the storage device 630. Each of components 610, 620, 630, 640, 650, and 660 is interconnected using various buses and can be mounted on a common motherboard or otherwise suitably mounted. Processor 610 can process instructions for execution within computing device 600, including instructions stored in memory 620 or on storage device 630 for displaying graphical information for a graphical user interface (GUI) on an external input / output device such as a display 680 coupled to the high-speed interface 640. In other embodiments, multiple processors and / or multiple buses, as well as multiple memories and various types of memory, can be suitably used. Furthermore, multiple computing devices 600 can be connected, with each device providing a portion of the necessary operation (e.g., as a server group, a set of blade servers, or a multiprocessor system).

[0054] Memory 620 stores information non-transitory within computing device 600. Memory 620 may be a computer-readable medium, a volatile storage unit, or a non-volatile storage unit. Non-transitory memory 620 may be a physical device for storing programs (e.g., instruction sequences) or data (e.g., program state information) on a temporary or permanent basis for use by computing device 600. Examples of non-volatile memory include, but are not limited to, flash memory and read-only memory (ROM) / programmable read-only memory (PROM) / erasable programmable read-only memory (EPROM) / electrically erasable programmable read-only memory (EEPROM) (e.g., commonly used in firmware, such as boot programs). Examples of volatile memory include, but are not limited to, random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), phase-change memory (PCM), and magnetic disks or magnetic tapes.

[0055] Storage device 630 provides mass storage for computing device 600. In some embodiments, storage device 630 is a computer-readable medium. In various embodiments, storage device 630 may be a floppy disk device, hard disk device, optical disk device, magnetic tape device, flash memory, or other similar solid-state storage device or device array (including devices in a storage area network or other configuration). In other embodiments, a computer program product is tangibly embodied in an information carrier. The computer program product contains instructions that, when executed, perform one or more methods, such as those described above. The information carrier is a computer or machine-readable medium, such as memory 620, storage device 630, or memory on processor 610.

[0056] High-speed controller 640 manages bandwidth-intensive operations of computing device 600, while low-speed controller 660 manages less bandwidth-intensive operations. This allocation of responsibilities is merely exemplary. In some embodiments, high-speed controller 640 is coupled to memory 620, display 680 (e.g., via a graphics processor or accelerator), and high-speed expansion port 650 (which can accept various expansion cards (not shown)). In some embodiments, low-speed controller 660 is coupled to storage device 630 and low-speed expansion port 690. Low-speed expansion port 690, which may include various communication ports (e.g., USB, Bluetooth, Ethernet, Wireless Ethernet), may be coupled to one or more input / output devices, such as keyboards, pointing devices, scanners, or network devices (such as switches or routers), for example, via a network adapter.

[0057] The computing device 600 can be implemented in a variety of different forms, as shown in the figure. For example, it can be implemented as a standard server 600a or multiple times in a set of such servers 600a, as a laptop computer 600b, or as part of a rack server system 600c.

[0058] Various implementations of the systems and techniques described herein can be implemented in digital electronic and / or optical circuits, integrated circuits, specially designed ASICs (Application-Specific Integrated Circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementations in one or more computer programs executable and / or interpretable on a programmable system, which includes at least one programmable processor, which may be dedicated or general-purpose, coupled to receive data and instructions from a storage system, at least one input device, and at least one output device, and to transmit data and instructions to the storage system, at least one input device, and at least one output device.

[0059] A software application (i.e., a software resource) can refer to computer software that instructs a computing device to perform a task. In some examples, a software application may be referred to as an "application," "app," or "program." Example applications include, but are not limited to, system diagnostic applications, system management applications, system maintenance applications, word processing applications, spreadsheet applications, messaging applications, media streaming applications, social networking applications, and game applications.

[0060] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for a programmable processor and may be implemented in high-level procedural and / or object-oriented programming languages ​​and / or in assembly / machine language. As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, non-transitory computer-readable medium, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) used to provide machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term “machine-readable signal” refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0061] The processes and logical flows described in this specification can be executed by one or more programmable processors (also known as data processing hardware) that execute one or more computer programs to perform functions by manipulating input data and generating output. The processes and logical flows can also be executed by special-purpose logic circuitry (e.g., FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits)). For example, processors suitable for executing computer programs include both general-purpose and special-purpose microprocessors, and any one or more processors of any kind of digital computer. Typically, the processor receives instructions and data from read-only memory or random access memory, or both. The basic elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or operatively coupled to them to receive data from or transfer data to, or both. However, a computer does not need to have such devices. Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as: semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0062] To provide interaction with the user, one or more aspects of this disclosure can be implemented on a computer having a display device for displaying information to the user (e.g., a CRT (cathode ray tube), LCD (liquid crystal display) monitor, or touchscreen) and optionally a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Additionally, the computer can interact with the user by sending documents to and receiving documents from devices used by the user (e.g., by sending a webpage to a web browser in response to a request received from a web browser on the user's client device).

[0063] Many embodiments have been described. However, it should be understood that various modifications can be made without departing from the spirit and scope of this disclosure. Therefore, other embodiments are within the scope of the appended claims.

Claims

1. A method for simulating network configuration, the method comprising: The data processing hardware receives changes to one or more parameters of the production network model of the network. The data processing hardware generates a simulated network model based on the production network logs, which include the production network model, and the simulated network model includes changes to one or more parameters. The data processing hardware is used to analyze the simulated network flow within the simulated network model. The data processing hardware generates a report that includes the impact of changes to one or more parameters on the network, the report indicating the differences between the production network model and the simulated network model; In response to generating the report, acceptance of changes to the one or more parameters is received at the data processing hardware; as well as In response to receiving acceptance of a change to the one or more parameters, the one or more parameter changes are implemented in the network via the data processing hardware.

2. The method according to claim 1, further comprising: The production network log, which includes the recording workflow of the production network model, is received at the data processing hardware. as well as The data processing hardware simulates the recording workflow of the production network model within the simulated network model to generate simulated network logs.

3. The method according to claim 2, wherein, The analysis of the simulated network flow includes: The production network logs are compared with the simulated network logs using the data processing hardware; and The data processing hardware identifies the differences between the production network logs and the simulated network logs.

4. The method according to claim 2, wherein, The production network log is one of the virtual private connection flow logs and firewall rule logs.

5. The method of claim 1, further comprising determining the impact of the change in the one or more parameters on the production network model by means of the data processing hardware.

6. The method according to claim 5, wherein, Determining the impact of the changes to the one or more parameters on the production network model includes determining the impact on at least one of network reachability, firewall hit rate predicted by firewall shadow rules, user intent rules, security compliance rules, and resource quotas and utilization.

7. The method according to claim 1, wherein, Generating the simulated network model involves incrementally incorporating one or more parameters into the production network model using the data processing hardware.

8. The method of claim 1, further comprising receiving one or more invariant parameters of the production network model via the data processing hardware.

9. The method according to any one of claims 1 to 8, further comprising changing the configuration of the network via the data processing hardware when the effect of the change of the one or more parameters on the network is acceptable.

10. A system comprising: Data processing hardware; as well as Memory hardware communicating with the data processing hardware, the memory hardware storing instructions that, when executed on the data processing hardware, cause the data processing hardware to perform operations, the operations including: One or more parameters of the production network model of the receiving network are changed; A simulated network model is generated based on the production network logs of the recorded workflow, including the production network model, wherein the simulated network model includes changes to one or more parameters. Analyze the simulated network flow within the simulated network model; Generate a report that includes the impact of the changes in the one or more parameters on the network, the report indicating the differences between the production network model and the simulated network model; In response to generating the report, receive acceptance of changes to the one or more parameters; and In response to receiving acceptance of a change to the one or more parameters, the one or more parameter changes are implemented in the network.

11. The system according to claim 10, wherein, The operation also includes: Receive the production network log, which includes the recording workflow of the production network model; and The recording workflow of the production network model is simulated within the simulated network model to generate simulated network logs.

12. The system according to claim 11, wherein, The analysis of the simulated network flow includes: Compare the production network logs with the simulated network logs; and Identify the differences between the production network logs and the simulated network logs.

13. The system according to claim 11, wherein, The production network log is one of the virtual private connection flow logs and firewall rule logs.

14. The system according to claim 10, wherein, The operation also includes determining the impact of changes to the one or more parameters on the production network model.

15. The system according to claim 14, wherein, Determining the impact of the changes to the one or more parameters on the production network model includes determining the impact on at least one of network reachability, firewall hit rate predicted by firewall shadow rules, user intent rules, security compliance rules, and resource quotas and utilization.

16. The system according to claim 10, wherein, Generating the simulated network model involves incrementally incorporating the one or more parameters into the production network model.

17. The system according to claim 10, wherein, The operation also includes receiving one or more invariant parameters of the production network model.

18. The system according to any one of claims 10 to 17, wherein, The operation also includes changing the network configuration when the impact of the change in one or more parameters on the network is acceptable.

19. A non-transitory computer-readable storage medium including instructions that, when executed by a data processing apparatus, cause the data processing apparatus to perform operations, the operations including: One or more parameters of the production network model of the receiving network are changed; A simulated network model is generated based on the production network logs of the recorded workflow, including the production network model, wherein the simulated network model includes changes to one or more parameters. Analyze the simulated network flow within the simulated network model; Generate a report that includes the impact of the changes in the one or more parameters on the network, the report indicating the differences between the production network model and the simulated network model; In response to the report, receive acceptance of the change to the one or more parameters; as well as In response to acceptance of the one or more parameter changes, the one or more parameter changes are implemented in the network.

20. The non-transitory computer-readable storage medium according to claim 19, wherein, The operation also includes: Receive the production network log, which includes the recording workflow of the production network model; and The recording workflow of the production network model is simulated within the simulated network model to generate simulated network logs.

21. The non-transitory computer-readable storage medium according to claim 20, wherein, The analysis of the simulated network flow includes: Compare the production network logs with the simulated network logs; and Identify the differences between the production network logs and the simulated network logs.

22. The non-transitory computer-readable storage medium according to claim 20, wherein, The production network log is one of the virtual private connection flow logs and firewall rule logs.

23. The non-transitory computer-readable storage medium according to claim 19, wherein, The operation also includes determining the impact of changes to the one or more parameters on the production network model.

24. The non-transitory computer-readable storage medium according to claim 23, wherein, Determining the impact of the changes to the one or more parameters on the production network model includes determining the impact on at least one of network reachability, firewall hit rate predicted by firewall shadow rules, user intent rules, security compliance rules, and resource quotas and utilization.

25. The non-transitory computer-readable storage medium according to claim 19, wherein, Generating the simulated network model involves incrementally incorporating the one or more parameters into the production network model.

26. The non-transitory computer-readable storage medium according to claim 19, wherein, The operation also includes receiving one or more invariant parameters of the production network model.

27. The non-transitory computer-readable storage medium according to any one of claims 19 to 26, wherein, The operation also includes changing the network configuration when the impact of the change in one or more parameters on the network is acceptable.

Images