Supporting supply neutral policy configuration on a network device with supply-

Abstract

Embodiments of the present disclosure relate to supporting provider neutral policy configuration on a network device having provider-specific policy configuration. A network device may receive a provider neutral policy configuration and may convert the provider neutral policy configuration into a first family filter and a second family filter. The network device may associate each of the first family of filters and the second family of filters with a routing instance and an interface, and may generate a policy configuration supported by the network device based on the first family of filters, the second family of filters, the routing instance, and the interface.

Description

Background Art

[0001] A firewall is a component in a network device that provides network security, classifies network traffic, monitors network traffic, etc. based on various conditions applied to network traffic characteristics such as content, entry points, exit points, etc. For example, if a packet meets a set of conditions, the firewall can perform one or more actions. Summary of the invention

[0002] Some implementations described herein are directed to a method. The method may include receiving, by a network device, a vendor-neutral policy configuration, and converting the vendor-neutral policy configuration into a first family of filters and a second family of filters. The method may include associating each filter in the first family of filters and the second family of filters with a routing instance and an interface, and generating a policy configuration supported by the network device based on the first family of filters, the second family of filters, the routing instance, and the interface.

[0003] Some implementations described herein relate to a network device. The network device may include one or more memories and one or more processors coupled to the one or more memories. One or more processors may be configured to receive a supplier-neutral policy configuration and convert the supplier-neutral policy configuration into a first family filter and a second family filter. One or more processors may be configured to associate each filter in the first family filter and the second family filter with a routing instance and an interface, and generate a policy configuration supported by the network device based on the first family filter, the second family filter, the routing instance and the interface. One or more processors may be configured to receive a packet and process the packet using the policy configuration to generate a first operating state data associated with the first family filter and a second operating state data associated with the second family filter.

[0004] Some implementations described herein relate to a non-transitory computer-readable medium storing an instruction set. The instruction set, when executed by one or more processors of a network device, can cause the network device to receive a vendor-neutral policy configuration and convert the vendor-neutral policy configuration into a first family of filters and a second family of filters. The instruction set, when executed by one or more processors of the network device, can cause the network device to associate each filter in the first family of filters and the second family of filters with a routing instance and an interface, and generate a policy configuration supported by the network device based on the first family of filters, the second family of filters, the routing instance, and the interface, wherein the policy configuration is for a firewall component of the network device. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figures 1A to 1G is an illustration of examples associated with supporting vendor-neutral policy configuration on a network device having vendor-specific policy configuration.

[0006] Figure 2 is an illustration of an example environment in which the systems and / or methods described herein may be implemented.

[0007] Figure 3 and Figure 4 yes Figure 2 An illustration of example components of one or more devices.

[0008] Figure 5 is a flow chart of an example process for supporting vendor-neutral policy configuration on a network device having vendor-specific policy configuration. DETAILED DESCRIPTION

[0009] The following detailed description of example implementations refers to the accompanying drawings.The same reference numbers in different drawings may identify the same or similar elements.

[0010] A filter is the basic unit of a firewall component of a network device and may include a set of terms or rules. Each term may include a match condition and a set of actions. A match condition may include a condition for determining a match with a packet. If the packet meets the match condition present in a term, a corresponding action may be applied to the packet. The firewall component may process the packet based on each term in the term until the packet is accepted or discarded.

[0011] OpenConfig provides a set of vendor-neutral data models (e.g., for firewalls) based on the operational needs of use cases and the requirements of multiple network operators. In an OpenConfig network instance, both filters and interfaces are located under the routing instance hierarchy, and policies are bound to the interface. This associates filters with routing instances and interfaces. An OpenConfig network instance filter configuration can include Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) matching within a single filter and within the same project or rule. In contrast, vendor-specific filter configurations can be associated with an interface or routing instance, IPv4 and IPv6 matching cannot be under the same project or rule, and only layer 3 family filters can be associated with a routing instance.

[0012] Therefore, current technologies for providing firewall components in network devices consume computing resources (e.g., processing resources, memory resources, communication resources, etc.), networking resources, etc., which are associated with providing supplier-specific filter configurations that do not support supplier-neutral filter configurations, failing to filter services associated with supplier-neutral filter configurations, handling security issues caused by failing to filter services associated with supplier-neutral filter configurations, etc.

[0013] Some implementations described herein relate to a network device that supports a supplier-neutral policy configuration on a network device with a supplier-specific policy configuration. For example, the network device may receive a supplier-neutral policy configuration, and may convert the supplier-neutral policy configuration into a first family filter and a second family filter. The network device may associate each filter in the first family filter and the second family filter with a routing instance and an interface, and may generate a policy configuration supported by the network device based on the first family filter, the second family filter, the routing instance, and the interface. The network device may receive a packet, and may process the packet using the policy configuration to generate a first operating state data associated with the first family filter and a second operating state data associated with the second family filter. The network device may store the first operating state data in a first data structure, and may store the second operating state data in a second data structure. The network device may receive a request for operating state data associated with a supplier-neutral policy configuration, may aggregate the first operating state data from the first data structure and the second operating state data from the second data structure to generate operating state data associated with the supplier-neutral policy configuration, and may return operating state data associated with the supplier-neutral policy configuration.

[0014] In this way, the network device supports a supplier-neutral policy configuration on a network device with a supplier-specific policy configuration. For example, the network device can divide the supplier-neutral policy configuration into two separate layer 3 filters (e.g., a first filter for a home IPv4 address matching condition and a second filter for a home IPv6 address matching condition). The network device can associate the first filter and the second filter with the routing instance and the interface by binding the first filter and the second filter to the routing instance and by adding an internal interface matching condition to each of the items in the first filter and the second filter. Since the first filter and the second filter are separate, the network device can maintain corresponding operational status data for each of the first filter and the second filter, respectively. Whenever the operational status data is requested, the network device can aggregate the corresponding operational status data of each of the first filter and the second filter. Therefore, the network device saves computing resources, networking resources, etc., which would otherwise be consumed by providing a supplier-specific filter configuration that fails to support a supplier-neutral filter configuration, failing to filter a business associated with a supplier-neutral filter configuration, handling security issues caused by failing to filter a business associated with a supplier-neutral filter configuration, etc.

[0015] Figures 1A to 1G is an illustration of an example 100 associated with supporting vendor-neutral policy configuration on a network device having a vendor-specific policy configuration. Figures 1A to 1GAs shown, example 100 includes a user device and a server device associated with a network of network devices. Further details of user devices, server devices, networks, and network devices are provided elsewhere herein.

[0016] like Figure 1A As shown, and by reference numeral 105, the network device can receive a supplier-neutral policy configuration. For example, the network device may not initially support supplier-neutral policy configurations, such as openconfig network instance (OC-NI) policy configurations, openconfig (OC) access control list (ACL) policy configurations, and the like. OC-NI policy configurations may include layer 3 forwarding constructs (e.g., virtual routing and forwarding (VRF) instances), layer 2 instances (e.g., virtual switch instances (VSI)), hybrid layer 2 and layer 3 instances, OC-NI Yang models with Yang definitions, and the like. Openconfig ACL policy configurations may include individual ACL rules that specify matching criteria based on fields in a packet, actions that define how matching packets should be processed, OC ACL Yang models with Yang definitions, OC ACL enhanced Yang models with Yang definitions, and the like. A user device may generate a supplier-neutral policy configuration, and may provide the supplier-neutral policy configuration to the network device. The network device may receive the supplier-neutral policy configuration from a user device or from another device (e.g., a network controller).

[0017] In one example, a vendor-neutral policy configuration may include the following (or similar) syntax:

[0018]

[0019]

[0020] like Figure 1B As shown, and by reference numeral 110, the network device can convert a supplier-neutral policy configuration to a first family of filters and a second family of filters. For example, the network device can convert the supplier-neutral policy configuration by dividing the supplier-neutral policy configuration into two separate layer 3 filters (e.g., a first family of filters and a second family of filters). In some implementations, the first family of filters is used for a series of IPv4 address matching conditions (INET), and the second family of filters is used for a series of IPv6 address matching conditions (INET6). In some implementations, the first family of filters includes a first set of items associated with the IPv4 address matching conditions, and the second family of filters includes a second set of items associated with the IPv6 address matching conditions. In one example, the network device can convert the supplier-neutral policy configuration to the first family of filters and the second family of filters using the following (or similar) syntax:

[0021]

[0022]

[0023]

[0024] The above example shows how one policy (e.g., dscp-steer) can be converted to two family filters, a first family filter for family INET (e.g., dscp-steer-ipv4-n1) and a second family filter for family INET6 (e.g., dscp-steer-ipv6-n1). IPv4 matches can be copied to the first family filter, IPv6 matches can be copied to the second family filter, and actions can be copied to both filters. This conversion or translation of a vendor-neutral policy configuration to multiple filters enables a network device to provide the same behavior as any family filter applied to a routing table.

[0025] If the network device receives a new vendor-neutral policy configuration (e.g., an OC-NI policy configuration), the network device may identify the network instance name and the policy name in the new vendor-neutral policy configuration. For each rule under the policy, the network device may repeat the following steps. If there is an IPv4 match under the rule, the network device may create a first family filter whose name has a combination of the policy name, IPv4, the network instance name, and the project name (e.g., the rule name). If there is an IPv6 match under the rule, the network device may create a second family filter whose name has a combination of the policy name, IPv6, the network instance name, and the project name (e.g., the rule name). The network device may identify an IPv4 match under the OC-NI rule, and may copy the IPv4 match to the project under the first family filter. The network device may identify an IPv6 match under the OC-NI rule, and may copy the IPv6 match to the project under the second family filter. The network device may clone actions (if any) to the projects of the first family filter, and may copy actions (if any) to the projects of the second family filter. The network device may apply the first family filter and the second family filter to the routing table. If the rule does not include an IPv4 match, the corresponding item of the first family of filters may be skipped. If the rule does not include an IPv6 match, the corresponding item of the second family of filters may be skipped.

[0026] In one example, a network device may process a new vendor-neutral policy configuration according to the following (or similar) syntax:

[0027]

[0028]

[0029] like Figure 1C As shown, and by reference numeral 115, the network device can associate each filter in the first family of filters and the second family of filters with the routing instance and the interface. For example, the network device can associate each filter in the first family of filters and the second family of filters with the routing instance by binding the first family of filters and the second family of filters to the routing instance. The network device can associate each filter in the first family of filters and the second family of filters with the interface by adding an internal interface match condition to each of the items in the first family of filters and the second family of filters.

[0030] like Figure 1D As shown, and by reference numeral 120, the network device can generate a policy configuration supported by the network device based on the first family of filters, the second family of filters, the routing instance, and the interface. For example, after dividing the supplier-neutral policy configuration into the first family of filters and the second family of filters and associating the first family of filters and the second family of filters with the routing instance and the interface, the supplier-neutral policy configuration can be converted into a policy configuration understood and supported by the network device. In this way, the network device can support supplier-neutral policy configurations as well as supplier-specific policy configurations.

[0031] like Figure 1E As shown, and by reference numeral 125, a network device may receive a packet. For example, a user device may generate network traffic (e.g., a packet) and may provide the packet to a network device. The network device may receive the packet from a user device. In some implementations, the network device may receive the packet from a server device or from another network device.

[0032] like Figure 1F As shown, and by reference numeral 130, a network device may process a packet using a policy configuration to generate first operating state data associated with a first family of filters and second operating state data associated with a second family of filters. For example, a firewall component of a network device may receive a packet and may process the packet using a policy configuration. Processing the packet using the policy configuration may cause the first family of filters to generate first operating state data (e.g., monitoring data and telemetry data) and may cause the second family of filters to generate second operating state data. The operating state data (e.g., monitoring data and telemetry data) of the supplier-neutral policy configuration may be provided along with the configuration data. During the configuration phase, a supplier-neutral policy configuration that includes both IPv4 and IPv6 matches in a single filter is divided into two layer 3 family filters. Therefore, the first family of filters generates first operating state data, and the second family of filters generates second operating state data. In one example, two layer 3 family filters may generate first operating state data and second operating state data according to the following (or similar) syntax:

[0033]

[0034] Splitting a single filter / policy (e.g., dscp-steer) into a first family of filters (e.g., dscp-steer-ipv4-n1) and a second family of filters (e.g., dscp-steer-ipv6-n1) creates a problem in returning operational status data. The operational status data from the two separate filters cannot be returned directly because only one filter is configured for the vendor-neutral policy configuration (e.g., vendor-neutral policy configuration). Instead, the operational status data from the first family of filters and the second family of filters needs to be aggregated into a single filter and returned to the requester. Figure 1F and Figure 1G Describes how network devices can solve this problem.

[0035] like Figure 1F As further shown in FIG. 1 and by reference numeral 135, the network device may store the first operating state data in a first data structure. For example, the network device may be associated with a first data structure (e.g., a database, a table, a list, etc.) and a second data structure. When the first family of filters generates the first operating state data (e.g., based on processing a packet), the network device may store the first operating state data in the first data structure. In some implementations, when storing the first operating state data in the first data structure, the network device may utilize a key (e.g., network instance+policy name, value=filter information).

[0036] like Figure 1F As further shown in FIG. 1 and by reference numeral 140, the network device can store the second operating state data in the second data structure. For example, when the second family of filters generates the second operating state data (e.g., based on processing the packet), the network device can store the second operating state data in the second data structure. In some implementations, when storing the second operating state data in the second data structure, the network device can utilize a key (e.g., network instance+policy name, value=filter information).

[0037] like Figure 1G As shown, and by reference numeral 145, a network device can receive a request for operational status data associated with a vendor-neutral policy configuration. For example, a user device can generate a request for operational status data associated with a vendor-neutral policy configuration and can provide the request to the network device. The network device can receive the request for operational status data associated with the vendor-neutral policy configuration from the user device or from another device (e.g., a server device). In one example, the request can include a request for operational status data for a policy (e.g., dscp-steer) under a network instance (e.g., n1).

[0038] like Figure 1G As further shown in FIG. 1 and by reference numeral 150, the network device may aggregate first operational state data from a first data structure and second operational state data from a second data structure to generate operational state data associated with a supplier-neutral policy configuration. For example, based on a request for operational state data associated with a supplier-neutral policy configuration, the network device may perform a lookup for a key (e.g., n1+dscp-steer) in the first data structure to retrieve first filter information, and may perform a lookup for a key in the second data structure to retrieve second filter information. The network device may retrieve a first rule associated with the first filter information and a second rule associated with the second filter information. For each first rule in the first rules, the network device may retrieve a first match and a first action. For each second rule in the second rules, the network device may retrieve a second match and a second action. The first filter information, the first rule, the first match, and the first action may correspond to the first operational state data. The second filter information, the second rule, the second match, and the second action may correspond to the second operational state data. The network device may aggregate the first operational state data and the second operational state data to generate operational state data associated with the supplier-neutral policy configuration.

[0039] In one example, the network device may aggregate the first operating status data and the second operating status data to generate the operating status data according to the following (or similar) syntax:

[0040]

[0041]

[0042] like Figure 1G As further shown in FIG. 1 and by reference numeral 155, the network device may return operational status data. For example, the network device may return operational status data associated with the supplier-neutral policy configuration to a requestor of the operational status data. In some implementations, the network device may return operational status data associated with the supplier-neutral policy configuration to a user device, a server device, or another device.

[0043] Furthermore, the implementations described herein may be used for ACLs or policies that do not support both IPv4 and IPv6 under the same rule, and may be used for vendor-neutral models, such as openconfig models that are not suitable for native Yang models or are not supported by hardware.

[0044] In this way, the network device supports supplier-neutral policy configuration on the network device with supplier-specific policy configuration. For example, the network device can divide the supplier-neutral policy configuration into two separate layer 3 filters (e.g., a first filter and a second filter). The network device can associate the first filter and the second filter with the routing instance and the interface by binding the first filter and the second filter to the routing instance and adding an internal interface matching condition to each of the items in the first filter and the second filter. Since the first filter and the second filter are separate, the network device can maintain corresponding operation status data for each filter in the first filter and the second filter respectively. Whenever the operation status data is requested, the network device can aggregate the corresponding operation status data of each filter in the first filter and the second filter. Therefore, the network device saves computing resources, networking resources, etc., which would otherwise be consumed by providing a supplier-specific filter configuration that does not support a supplier-neutral filter configuration, failing to filter the business associated with the supplier-neutral filter configuration, handling security issues caused by failing to filter the business associated with the supplier-neutral filter configuration, etc.

[0045] As mentioned above, providing Figures 1A to 1G As an example. Other examples may differ from the reference Figures 1A to 1G as described. Figures 1A to 1G The number and arrangement of the devices shown in are provided as examples. Figures 1A to 1G There may be more devices, fewer devices, different devices, or differently arranged devices than those shown in FIG. Figures 1A to 1G Two or more of the devices shown in may be implemented in a single device, or Figures 1A to 1G The single device shown in can be implemented as multiple distributed devices. Additionally or alternatively, Figures 1A to 1G The device group (e.g., one or more devices) shown in FIG. 1 may perform the operations described by Figures 1A to 1G One or more functions performed by another device group shown in .

[0046] Figure 2 2 is an illustration of an example environment 200 in which the systems and / or methods described herein may be implemented. Figure 2 As shown, environment 200 may include user device 210, network device group 220 (shown as network device 220-1 through network device 220-N), server device 230, and network 240. The devices of environment 200 may be interconnected via wired connections, wireless connections, or a combination of wired and wireless connections.

[0047] User device 210 may include one or more devices capable of receiving, generating, storing, processing, and / or providing information, as described elsewhere herein. User device 210 may include a communication device and / or a computing device. For example, user device 210 may include a wireless communication device, a mobile phone, a user device, a laptop computer, a tablet computer, a desktop computer, a game console, a set-top box, a wearable communication device (e.g., a smart watch, smart glasses, a head-mounted display, or a virtual reality headset), or a similar type of device.

[0048] The network device 220 includes one or more devices capable of receiving, processing, storing, routing and / or providing services (e.g., packets or other information or metadata) in a manner described herein. For example, the network device 220 may include a router, such as a label switching router (LSR), a label edge router (LER), an ingress router, an egress router, a provider router (e.g., a provider edge router or a provider core router), a virtual router, a route reflector, a regional border router, or another type of router. Additionally or alternatively, the network device 220 may include a gateway, a switch, a firewall, a hub, a bridge, a reverse proxy, a server (e.g., a proxy server, a cloud server, or a data center server), a load balancer, and / or similar devices. In some implementations, the network device 220 may be a physical device implemented in a housing, such as a chassis. In some implementations, the network device 220 may be a virtual device implemented by one or more computer devices of a cloud computing environment or a data center. In some implementations, the network device group 220 may be a data center node group for routing traffic flows through the network 240.

[0049] Server device 230 may include one or more devices capable of receiving, generating, storing, processing, providing and / or routing information, as described elsewhere herein. Server device 230 may include a communication device and / or a computing device. For example, server device 230 may include a server, such as an application server, a client server, a network server, a database server, a host server, a proxy server, a virtual server (e.g., executed on computing hardware) or a server in a cloud computing system. In some implementations, server device 230 includes computing hardware used in a cloud computing environment.

[0050] The network 240 includes one or more wired and / or wireless networks. For example, the network 240 may include a packet-switched network, a cellular network (e.g., a fifth generation (5G) network, a fourth generation (4G) network such as a long-term evolution (LTE) network, and / or a third generation (3G) network), a code division multiple access (CDMA) network, a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber-optic-based network, a cloud computing network, etc., and / or a combination of these or other types of networks.

[0051] Figure 2 The number and arrangement of devices and networks shown in are provided as examples. Figure 2 There may be additional devices and / or networks, fewer devices and / or networks, different devices and / or networks, or differently arranged devices and / or networks than those shown in . Figure 2 Two or more of the devices shown in may be implemented in a single device, or Figure 2 The single device shown in FIG. 200 may be implemented as multiple distributed devices. Additionally or alternatively, a set of devices (eg, one or more devices) of environment 200 may perform one or more functions described as being performed by another set of devices of environment 200.

[0052] Figure 3 yes Figure 2 300. The example components may be included in device 300, which may correspond to user device 210, network device 220, and / or server device 230. In some implementations, user device 210, network device 220, and / or server device 230 may include one or more devices 300 and / or one or more components of device 300. Figure 3 As shown, device 300 may include a bus 310 , a processor 320 , a memory 330 , an input component 340 , an output component 350 , and a communication interface 360 ​​.

[0053] The bus 310 includes one or more components that enable wired and / or wireless communications between components of the device 300. The bus 310 may be coupled to the device 300 via an operational coupling, a communicative coupling, an electronic coupling, and / or an electrical coupling. Figure 3Two or more components of are coupled together. Processor 320 includes a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor, a controller, a microcontroller, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), and / or another type of processing component. Processor 320 is implemented in hardware, firmware, or a combination of hardware and software. In some implementations, processor 320 includes one or more processors that can be programmed to perform one or more operations or processes described elsewhere herein.

[0054] Memory 330 includes volatile and / or non-volatile memory. For example, memory 330 may include random access memory (RAM), read-only memory (ROM), a hard drive, and / or another type of memory (e.g., flash memory, magnetic memory, and / or optical memory). Memory 330 may include internal memory (e.g., RAM, ROM, or hard drive) and / or removable memory (e.g., removable via a universal serial bus connection). Memory 330 may be a non-transitory computer-readable medium. Memory 330 stores information, instructions, and / or software (e.g., one or more software applications) related to the operation of device 300. In some implementations, memory 330 includes one or more memories such as coupled to one or more processors (e.g., processor 320) via bus 310.

[0055] Input component 340 enables device 300 to receive input, such as user input and / or sensory input. For example, input component 340 may include a touch screen, a keyboard, a keypad, a mouse, a button, a microphone, a switch, a sensor, a global positioning system sensor, an accelerometer, a gyroscope, and / or an actuator. Output component 350 enables device 300 to provide output, such as via a display, a speaker, and / or a light emitting diode. Communication interface 360 ​​enables device 300 to communicate with other devices via wired connection and / or wireless connection. For example, communication interface 360 ​​may include a receiver, a transmitter, a transceiver, a modem, a network interface card, and / or an antenna.

[0056] Device 300 can perform one or more operations or processes described herein. For example, a non-transient computer-readable medium (e.g., memory 330) can store an instruction set (e.g., one or more instructions or codes) for execution by processor 320. Processor 320 can execute the instruction set to perform one or more operations or processes described herein. In some implementations, execution of the instruction set by one or more processors 320 causes one or more processors 320 and / or device 300 to perform one or more operations or processes described herein. In some implementations, hard-wired circuits can be used to replace or combine instructions to perform one or more operations or processes described herein. Additionally or alternatively, processor 320 can be configured to perform one or more operations or processes described herein. Therefore, the implementation described herein is not limited to any particular combination of hardware circuits and software.

[0057] Figure 3 The number and arrangement of components shown are provided as examples. Figure 3 Device 300 may include additional components, fewer components, different components, or differently arranged components than those shown in . Additionally or alternatively, a set of components (e.g., one or more components) of device 300 may perform one or more functions described as being performed by another set of components of device 300.

[0058] Figure 4 yes Figure 2 4. The example components may be included in device 400. Device 400 may correspond to network device 220. In some implementations, network device 220 may include one or more devices 400 and / or one or more components of device 400. Figure 4 As shown, the device 400 may include one or more input components 410-1 to 410-B (B≥1) (hereinafter collectively referred to as input component 410, and individually referred to as input component 410), a switching component 420, one or more output components 430-1 to 430-C (C≥1) (hereinafter collectively referred to as output component 430, and individually referred to as output component 430), and a controller 440.

[0059] The input component 410 may be one or more attachment points for a physical link and may be one or more entry points for incoming traffic such as packets. The input component 410 may process incoming traffic such as by performing data link layer encapsulation or decapsulation. In some implementations, the input component 410 may send and / or receive packets. In some implementations, the input component 410 may include an input line card that includes one or more packet processing components (e.g., in the form of an integrated circuit), such as one or more interface cards (IFCs), a packet forwarding component, a line card controller component, an input port, a processor, a memory, and / or an input queue. In some implementations, the device 400 may include one or more input components 410.

[0060] The switching component 420 can interconnect the input component 410 with the output component 430. In some implementations, the switching component 420 can be implemented via one or more crossbar switches, via a bus, and / or using a shared memory. The shared memory can be used as a temporary buffer to store packets from the input component 410 before they are ultimately scheduled to be delivered to the output component 430. In some implementations, the switching component 420 can enable the input component 410, the output component 430, and / or the controller 440 to communicate with each other.

[0061] Output component 430 can store packets and can schedule packets for transmission on an output physical link. Output component 430 can support data link layer encapsulation or decapsulation, and / or various higher-level protocols. In some implementations, output component 430 can send packets and / or receive packets. In some implementations, output component 430 may include an output line card, which includes one or more packet processing components (e.g., in the form of an integrated circuit), such as one or more IFCs, packet forwarding components, line card controller components, output ports, processors, memories, and / or output queues. In some implementations, device 400 may include one or more output components 430. In some implementations, input component 410 and output component 430 may be implemented by the same component set (e.g., an input / output component may be a combination of input component 410 and output component 430).

[0062] Controller 440 includes a processor in the form of, for example, a CPU, a GPU, an accelerated processing unit (APU), a microprocessor, a microcontroller, a DSP, an FPGA, an ASIC, and / or other types of processors. The processor is implemented in hardware, firmware, or a combination of hardware and software. In some implementations, controller 440 may include one or more processors that can be programmed to perform a function.

[0063] In some implementations, the controller 440 may include RAM, ROM, and / or another type of dynamic or static storage device (eg, flash memory, magnetic memory, optical memory, etc.) that stores information and / or instructions for use by the controller 440 .

[0064] In some implementations, the controller 440 can communicate with other devices, networks, and / or systems connected to the device 400 to exchange information about the network topology. The controller 440 can create a routing table based on the network topology information, can create a forwarding table based on the routing table, and can forward the forwarding table to the input component 410 and / or the output component 430. The input component 410 and / or the output component 430 can use the forwarding table to perform a route lookup for incoming and / or outgoing packets.

[0065] The controller 440 may perform one or more processes described herein. The controller 440 may perform these processes in response to executing software instructions stored by a non-transient computer readable medium. A computer readable medium is defined herein as a non-transient storage device. A memory device includes memory space within a single physical storage device or memory space distributed on multiple physical storage devices.

[0066] The software instructions may be read from another computer-readable medium or from another device via a communication interface into a memory and / or storage component associated with the controller 440. When executed, the software instructions stored in the memory and / or storage component associated with the controller 440 may cause the controller 440 to perform one or more processes described herein. Additionally or alternatively, hardwired circuitry may be used instead of or in combination with software instructions to perform one or more processes described herein. Therefore, the implementations described herein are not limited to any specific combination of hardware circuitry and software.

[0067] Figure 4 The number and arrangement of components shown are provided as examples. Figure 4 Device 400 may include additional components, fewer components, different components, or differently arranged components than those shown in . Additionally or alternatively, a set of components (e.g., one or more components) of device 400 may perform one or more functions described as being performed by another set of components of device 400.

[0068] Figure 5 is a flow chart of an example process 500 for supporting vendor-neutral policy configuration on a network device with vendor-specific policy configuration. In some implementations, Figure 5 One or more process blocks of may be performed by a network device (e.g., network device 220). In some implementations, Figure 5One or more process blocks of are performed by another device or device group that is separate from or includes the network device. Additionally or alternatively, Figure 5 One or more process blocks of may be performed by one or more components of device 300, such as processor 320, memory 330, input component 340, output component 350, and / or communication interface 360. Additionally or alternatively, Figure 5 One or more process blocks of may be performed by one or more components of device 400 , such as input component 410 , switching component 420 , output component 430 , and / or controller 440 .

[0069] like Figure 5 As shown, process 500 may include receiving a supplier-neutral policy configuration (block 510). For example, a network device may receive a supplier-neutral policy configuration, as described above. In some implementations, the supplier-neutral policy configuration is an openconfig network instance policy configuration. In some implementations, the supplier-neutral policy configuration is an openconfig access control list policy configuration. In some implementations, the supplier-neutral policy configuration includes a supplier-neutral data model.

[0070] like Figure 5 As further shown, process 500 may include converting a supplier-neutral policy configuration into a first family filter and a second family filter (block 520). For example, as described above, the network device may convert the supplier-neutral policy configuration into a first family filter and a second family filter. In some implementations, each filter in the first family filter and the second family filter is a layer 3 filter. In some implementations, the first family filter is used for a family Internet Protocol version 4 address matching condition. In some implementations, the second family filter is used for a family Internet Protocol version 6 address matching condition. In some implementations, the first family filter includes a first set of items and the second family filter includes a second set of items.

[0071] like Figure 5 As further shown, process 500 may include associating each filter in the first and second families of filters with a routing instance and an interface (block 530). For example, the network device may associate each filter in the first and second families of filters with a routing instance and an interface, as described above.

[0072] like Figure 5 As further shown, process 500 may include generating a policy configuration supported by the network device based on the first family of filters, the second family of filters, the routing instance, and the interface (block 540). For example, as described above, the network device may generate a policy configuration supported by the network device based on the first family of filters, the second family of filters, the routing instance, and the interface. In some implementations, the policy configuration is for a firewall component of the network device.

[0073] In some implementations, process 500 includes receiving a packet and processing the packet using a policy configuration to generate first operating state data associated with a first family of filters and second operating state data associated with a second family of filters. In some implementations, each of the first operating state data and the second operating state data is monitoring data or telemetry data. In some implementations, process 500 includes storing the first operating state data in a first data structure and storing the second operating state data in a second data structure.

[0074] In some implementations, process 500 includes receiving a request for operating status data associated with a supplier-neutral policy configuration, aggregating first operating status data from a first data structure and second operating status data from a second data structure to generate operating status data associated with the supplier-neutral policy configuration, and returning the operating status data associated with the supplier-neutral policy configuration.

[0075] although Figure 5 An example block diagram of process 500 is shown, but in some implementations, process 500 may include Figure 5 In some embodiments, the process 500 may include additional blocks, fewer blocks, different blocks, or blocks arranged in a different manner than those depicted in the process 500. Additionally or alternatively, two or more blocks of the process 500 may be executed in parallel.

[0076] The foregoing disclosure provides illustration and description, but is not intended to be exhaustive or to limit implementations to the precise forms disclosed. Modifications may be made in light of the above disclosure or may be acquired from practice of implementations.

[0077] As used herein, the term "component" is intended to be broadly interpreted as hardware, firmware, or a combination of hardware and software. Obviously, the systems and / or methods described herein can be implemented in different forms of hardware, firmware, and / or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods is not a limitation of the implementation. Therefore, the operation and behavior of the systems and / or methods are described herein without reference to specific software code-it should be understood that based on the description herein, the systems and / or methods can be implemented using software and hardware.

[0078] Although particular combinations of features are recited in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of the various implementations. In fact, many of these features may be combined in ways not specifically recited in the claims and / or disclosed in the specification. Although each dependent claim listed below may only directly depend on one claim, the disclosure of the various implementations includes each dependent claim in combination with every other claim in the claim set.

[0079] Unless explicitly described, any element, behavior or instruction used in this article should not be interpreted as critical or necessary. In addition, as used herein, the articles "one" and "an" are intended to include one or more items, and can be used interchangeably with "one or more". In addition, as used herein, the article "the" is intended to include one or more items quoted in conjunction with the article "the", and can be used interchangeably with "the one or more". In addition, as used herein, the term "set" is intended to include one or more items (e.g., related items, unrelated items, combinations of related and unrelated items, etc.), and can be used interchangeably with "one or more". If only one project is intended, the phrase "only one" or similar language is used. In addition, as used herein, the terms "have", "have", "contain", etc. are intended to be open terms. In addition, the phrase "based on" is intended to mean "at least partially based on", unless otherwise clearly stated. In addition, as used herein, when used in a series, the term "or" is intended to be inclusive, and can be used interchangeably with "and / or", unless otherwise clearly stated (e.g., if used in combination with "any one" or "only one item").

[0080] In the foregoing description, various exemplary embodiments have been described with reference to the accompanying drawings. However, it is clear that various modifications and changes may be made thereto, and additional embodiments may be implemented without departing from the broader scope of the invention as set forth in the appended claims. Accordingly, the description and drawings should be regarded as illustrative rather than restrictive.

Claims

1. A method comprising: Receiving, by the network device, a vendor-neutral policy configuration; converting, by the network device, the vendor neutral policy configuration into a first family of filters and a second family of filters; Associating, by the network device, each filter in the first family of filters and the second family of filters with a routing instance and an interface; as well as A policy configuration supported by the network device is generated by the network device based on the first family of filters, the second family of filters, the routing instance, and the interface.

2. The method according to claim 1, further comprising: Receive packets; as well as The packet is processed using the policy configuration to generate first operational state data associated with the first family of filters and second operational state data associated with the second family of filters. 3 . The method according to claim 2 , wherein each of the first operating status data and the second operating status data is monitoring data or telemetry data.

4. The method according to claim 2, further comprising: storing the first operating state data in a first data structure; as well as The second operating state data is stored in a second data structure.

5. The method according to claim 4, further comprising: receiving a request for operational status data associated with the vendor-neutral policy configuration; aggregating the first operational state data from the first data structure and the second operational state data from the second data structure to generate the operational state data associated with the vendor-neutral policy configuration; and The operational state data associated with the vendor-neutral policy configuration is returned.

6. The method of claim 1, wherein the vendor-neutral policy configuration is an openconfig network instance policy configuration.

7. The method of claim 1, wherein the vendor-neutral policy configuration is an openconfig access control list policy configuration.

8. A network device comprising: one or more memories; as well as One or more processors, coupled to the one or more memories, configured to: Receive a supply-side neutral policy configuration; converting the supplier-neutral policy configuration into a first family of filters and a second family of filters; associating each filter in the first family of filters and the second family of filters with a routing instance and an interface; generating a policy configuration supported by the network device based on the first family of filters, the second family of filters, the routing instance, and the interface; Receive packets; as well as The packet is processed using the policy configuration to generate first operational state data associated with the first family of filters and second operational state data associated with the second family of filters.

9. The network device of claim 8, wherein the vendor-neutral policy configuration comprises a vendor-neutral data model.

10. The network device of claim 8, wherein each filter in the first family of filters and the second family of filters is a layer 3 filter.

11. The network device according to claim 8, wherein the first filter family is used for grouping Internet Protocol version 4 address matching conditions.

12. The network device according to claim 8, wherein the second filter family is used for a group Internet Protocol version 6 address matching condition.

13. The network device of claim 8, wherein the first family of filters includes a first set of items and the second family of filters includes a second set of items.

14. The network device of claim 8, wherein the policy configuration is for a firewall component of the network device.

15. A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising: One or more instructions, when executed by one or more processors of a network device, cause the network device to: Receive a supply-side neutral policy configuration; converting the supplier-neutral policy configuration into a first family of filters and a second family of filters; associating each filter in the first family of filters and the second family of filters with a routing instance and an interface; and generating a policy configuration supported by the network device based on the first family of filters, the second family of filters, the routing instance, and the interface, The policy configuration is used for a firewall component of the network device.

16. The non-transitory computer readable medium of claim 15, wherein the one or more instructions further cause the network device to: Receive packets; processing the packet using the policy configuration to generate first operational state data associated with the first family of filters and second operational state data associated with the second family of filters; storing the first operating state data in a first data structure; as well as The second operating state data is stored in a second data structure.

17. The non-transitory computer readable medium of claim 16, wherein the one or more instructions further cause the network device to: receiving a request for operational status data associated with the vendor-neutral policy configuration; aggregating the first operational state data from the first data structure and the second operational state data from the second data structure to generate the operational state data associated with the vendor-neutral policy configuration; and The operational state data associated with the vendor-neutral policy configuration is returned.

18. The non-transitory computer-readable medium of claim 15, wherein the vendor-neutral policy configuration is an openconfig network instance policy configuration or an openconfig access control list policy configuration.

19. The non-transitory computer readable medium of claim 15, wherein each filter in the first family of filters and the second family of filters is a layer 3 filter.

20. The non-transitory computer readable medium of claim 15, wherein the first family filter is for a family Internet Protocol version 4 address matching condition, and the second family filter is for a family Internet Protocol version 6 address matching condition.

Images