Firewall management method and system and computer equipment

Abstract

The invention relates to a firewall management method and system and computer equipment. The method comprises the steps of obtaining a deployment script file based on firewall deployment demand data and device information of a plurality of resource pool servers; calling an Ansible operation and maintenance tool to execute the deployment script file to obtain deployment execution files respectively corresponding to the plurality of resource pool servers; sending each deployment execution file to a corresponding resource pool server, so that the resource pool server deploys the firewall based on the corresponding deployment execution file; and under the condition that each resource pool server feeds back deployment success information, testing each firewall. By adopting the method, the firewall deployment efficiency of multiple resource pools can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a firewall management method, system and computer equipment. Background Art

[0002] In a private cloud computing network, in order to meet the traffic security protection requirements of multiple resource pools, each resource pool needs to deploy an independent firewall for traffic protection. Although this approach can enhance security, it also means that a lot of firewall management work such as firewall deployment and testing is required, including configuring firewalls for each resource pool, conducting separate tests, and verifying firewall rules, which is a large workload.

[0003] The firewall management method in the related art is to first write a deployment script for the firewall and then run the deployment script in different resource pools respectively.

[0004] However, the above firewall management method has the problem of low efficiency when deploying firewalls for multiple resource pools. Summary of the invention

[0005] Based on this, it is necessary to provide a firewall management method, system and computer device that can improve the efficiency of deploying firewalls for multiple resource pools in response to the above technical problems.

[0006] In a first aspect, the present application provides a firewall management method, comprising:

[0007] Based on the firewall deployment requirement data and the device information of multiple resource pool servers, a deployment script file is obtained;

[0008] Call the Ansible operation and maintenance tool to execute the deployment script file to obtain the deployment execution files corresponding to multiple resource pool servers;

[0009] Sending each deployment execution file to the corresponding resource pool server respectively, so that the resource pool server deploys the firewall based on the corresponding deployment execution file;

[0010] When all resource pool servers report successful deployment, test each firewall.

[0011] In one embodiment, each firewall is tested, including:

[0012] Based on the firewall test requirement data, obtain the test script file;

[0013] Call the Ansible operation and maintenance tool to execute the test script file to obtain the test configuration execution files and test operation execution files corresponding to multiple resource pool servers respectively;

[0014] Send each test configuration execution file to the corresponding resource pool server, so that the resource pool server can configure the firewall based on the test configuration execution file;

[0015] When the resource pool server feeds back the test configuration success information, the test operation execution file is sent to the corresponding resource pool server respectively, so that the resource pool server can call the test virtual machine to test the firewall based on the test operation execution file, wherein the test virtual machine is deployed by the resource pool server based on the deployment execution file.

[0016] In one embodiment, the method further comprises:

[0017] Receive test results fed back by each resource pool server;

[0018] In the case that there is a test result that is the same as the expected result among the test results, the abnormal test result and the normal test result are analyzed and processed to obtain the test horizontal analysis result;

[0019] Analyze and process the abnormal test result and the historical test result corresponding to the abnormal server to obtain the test longitudinal analysis result; wherein the abnormal server is the resource pool server corresponding to the abnormal test result;

[0020] When at least one of the horizontal analysis result and the vertical analysis result indicates that the abnormal test result is a firewall failure, test abnormality alarm information is generated, and the abnormal alarm information includes the abnormal test result and resource pool information corresponding to the abnormal server.

[0021] In one embodiment, the method further comprises:

[0022] Get the resource recovery script file;

[0023] When the test results are the same as the expected results, call the Ansible operation and maintenance tool to execute the resource recovery script file to obtain resource recovery execution files corresponding to multiple resource pool servers respectively;

[0024] The resource recovery execution file is sent to the corresponding resource pool server, so that the resource pool server can recover the computing resources corresponding to the test virtual machine based on the resource recovery execution file.

[0025] In one embodiment, the method further comprises:

[0026] Obtain the monitoring script file used to monitor the operational reliability of each firewall;

[0027] Call the Ansible operation and maintenance tool to execute the monitoring script file, and obtain the monitoring execution files corresponding to multiple resource pool servers;

[0028] Send each monitoring execution file to the corresponding resource pool server, so that the resource pool server can detect the corresponding operating parameters of the firewall based on the monitoring execution file, and feedback the monitoring abnormal parameters if there are abnormalities in the operating parameters;

[0029] Analyze and process the monitoring abnormal parameters received from the resource pool server.

[0030] In one embodiment, analyzing and processing the monitoring abnormality parameters fed back by the received resource pool server includes:

[0031] Analyze and process the monitored abnormal parameters and the historical abnormal parameters corresponding to the monitored abnormal parameters to obtain the monitoring longitudinal analysis results;

[0032] Analyze and process the monitoring abnormality data corresponding to other resource pool servers based on the monitoring abnormality parameters to obtain the monitoring horizontal analysis results;

[0033] In the case where at least one of the monitoring longitudinal analysis result and the monitoring transverse analysis result represents that the monitoring abnormal parameter is real abnormal data, monitoring abnormality alarm information is generated, and the monitoring abnormality alarm information includes the monitoring abnormal parameter.

[0034] In a second aspect, the present application also provides a firewall management system, including:

[0035] The central node is used to obtain a deployment script file based on the firewall deployment requirement data and the device information of multiple resource pool servers, and transmit the deployment script file to the deployment node;

[0036] The deployment node is configured with the Ansible operation and maintenance tool, which is used to call the Ansible operation and maintenance tool to execute the deployment script file, obtain the deployment execution files corresponding to the multiple resource pool servers, and send each deployment execution file to the corresponding resource pool server, so that the resource pool server deploys the firewall based on the corresponding deployment execution file;

[0037] When each resource pool server feeds back deployment success information, the central node is also used to test each firewall.

[0038] In one embodiment, the firewall management system further includes a test node; wherein,

[0039] The central node is used to obtain the test script file based on the firewall test requirement data and transmit the test script file to the test node;

[0040] The test node is configured with an Ansible operation and maintenance tool, and is used to call the Ansible operation and maintenance tool to execute a test script file, obtain test configuration execution files and test operation execution files corresponding to multiple resource pool servers, and send each test configuration execution file to the corresponding resource pool server, so that the resource pool server can configure the firewall based on the test configuration execution file; and when each resource pool server feeds back test configuration success information, each test operation execution file is sent to the corresponding resource pool server, so that the resource pool server can call a test virtual machine based on the test operation execution file to test the firewall, wherein the test virtual machine is deployed by the resource pool server based on the deployment execution file.

[0041] In one of the embodiments, the firewall management system further includes a recycling node;

[0042] The central node is also used to obtain resource recovery script files and transmit the resource recovery script files to the recovery nodes;

[0043] The recycling node is configured with the Ansible operation and maintenance tool. When the test result is the same as the expected result, the Ansible operation and maintenance tool is called to execute the resource recycling script file, obtain the resource recycling execution files corresponding to the multiple resource pool servers, and send the resource recycling execution files to the resource pool server, so that the resource pool server can recycle the computing resources corresponding to the test virtual machine based on the resource recycling execution files.

[0044] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in the first aspect when executing the computer program.

[0045] The above-mentioned firewall management method, system and computer device obtain a deployment script file based on firewall deployment demand data and device information of multiple resource pool servers; call the Ansible operation and maintenance tool to execute the deployment script file to obtain deployment execution files corresponding to multiple resource pool servers respectively; send each deployment execution file to the corresponding resource pool server respectively, so that the resource pool server can deploy the firewall based on the corresponding deployment execution file; when each resource pool server feeds back deployment success information, test each firewall; in this way, by converting the firewall deployment demand data and the device information of multiple resource pool servers into a deployment script file, calling the Ansible operation and maintenance tool to execute the deployment script file, it is possible to realize batch deployment of firewalls for multiple resource pool servers, thereby improving the efficiency of deploying firewalls in multiple resource pools. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 An application environment diagram of a firewall management method in an embodiment;

[0048] Figure 2 A diagram of an application environment of a firewall management method in another embodiment;

[0049] Figure 3 A flowchart of a firewall management method in one embodiment;

[0050] Figure 4 It is a flowchart of the steps of testing each firewall in one embodiment;

[0051] Figure 5 A flowchart of a firewall management method according to another embodiment;

[0052] Figure 6 A flowchart of a firewall management method according to another embodiment;

[0053] Figure 7 A flowchart of a firewall management method according to another embodiment;

[0054] Figure 8 A flowchart of steps for analyzing and processing monitoring abnormality parameters fed back by a resource pool server in one embodiment;

[0055] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0057] The firewall management method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. The management server 102 communicates with each resource pool server 104 through the network. Among them, the management server 102 can be implemented by a firewall management system composed of an independent terminal device or multiple independent terminal devices. The resource pool is a geographical area concept, that is, a circle with a delay as the radius, which usually includes access delay (that is, the delay for users in the circle to obtain services must be within a certain range, such as 100ms), coverage (for example, if the delay exceeds the delay, it will affect the service quality, so it is recommended to plan another region / Region) and disaster recovery (each Region is usually distributed in a different geographical location, of course, the same geographical location can also plan different Regions as needed) attributes. The resource pool server 104 refers to the server corresponding to each resource pool, which is used to deploy a firewall; the resource pool server 104 can be implemented by an independent server or a server cluster composed of multiple servers. The firewall is a system composed of computer hardware and software, deployed at the network boundary, and is a connecting bridge between the internal network and the external network. At the same time, it protects the data entering and leaving the network boundary, prevents malicious intrusion, the spread of malicious code, etc., and ensures the security of internal network data.

[0058] In an exemplary embodiment, please refer to Figure 2 The management server 102 includes multiple central nodes and deployment nodes. The central node is used as a core machine and is installed with nginx service, management service and user operation front-end console, which is used to collect resource pool information where firewalls need to be deployed and server information corresponding to the resource pool, as well as to obtain user input demand data, convert the demand data into a script file, and transmit it to the deployment node through the nginx service; the deployment node is installed with Ansible operation and maintenance tool, which is used to call Ansible operation and maintenance tool to read the script file, load the command module, determine the execution task, and generate the corresponding execution file based on the script file and send it to the remote resource pool server.

[0059] Among them, Ansible is an automated operation and maintenance tool developed based on Python, which can realize batch system configuration, batch program deployment, batch command execution and other functions. The script file, also known as PlayBook, is the configuration, deployment and orchestration language of Ansible. It can be described as a plan that requires the remote host to execute commands, or a set of commands for a group of IT programs to run. Through the detailed description of the script file, executing a series of tasks in it can make the remote host reach the expected state.

[0060] In an exemplary embodiment, Figure 2 As shown, a firewall management method is provided, which is applied to Figure 1The management server 102 in FIG. 1 is taken as an example to illustrate, including the following steps 302 to 308. Among them:

[0061] Step 302, based on the firewall deployment requirement data, obtain a deployment script file.

[0062] Exemplarily, the firewall deployment requirement data may be obtained based on relevant requirement information input by a user, or may be a firewall deployment strategy determined from a plurality of pre-stored firewall deployment strategies based on the traffic scale, business requirements, etc. corresponding to the resource pool.

[0063] Exemplarily, the firewall deployment requirement data may be in the format of JSON, YAML, text, or file, etc. JSON and YAML are formats for serializing and transmitting data.

[0064] Exemplarily, the firewall deployment requirement data includes information such as the region identifier (region_id), CPU, memory, disk and image, IP, HAVIP (Private High-Availability Virtual IP Address) corresponding to the resource pool.

[0065] The deployment script file refers to a script file that is called and executed by the Ansible operation and maintenance tool to deploy a firewall on a remote host.

[0066] Exemplarily, the central node in the management server obtains a deployment script file based on the firewall deployment requirement data and the device information of multiple resource pool servers.

[0067] Step 304: Call the Ansible operation and maintenance tool to execute the deployment script file to obtain deployment execution files corresponding to the multiple resource pool servers.

[0068] Exemplarily, the central node in the management server sends the deployment script file to the deployment node; the deployment node calls the installed Ansible operation and maintenance tool to execute the deployment script file, and generates deployment execution files corresponding to multiple resource pool servers respectively.

[0069] The deployment execution file may be a Python script.

[0070] Step 306: Send each deployment execution file to the corresponding resource pool server, so that the resource pool server deploys the firewall based on the corresponding deployment execution file.

[0071] Among them, each deployment execution file is sent to each remote resource pool server through the SSH protocol. The resource pool server pulls up the firewall virtual machine in turn according to the received Python script, and returns the execution result to the management server after the pull-up is successful. Exemplarily, the process of deploying the firewall based on the corresponding deployment execution file by the resource pool server includes: creating a virtual machine, configuring the network interface, installing the firewall software or virtual firewall application, and configuring the firewall policy.

[0072] Exemplarily, the deployment node sends the deployment execution files to the corresponding resource pool servers respectively, so that the resource pool servers deploy the firewall based on the corresponding deployment execution files, and receive the execution feedback results of the resource pool servers.

[0073] Step 308: When each resource pool server feeds back deployment success information, each firewall is tested.

[0074] The firewall management method provided in the above embodiment obtains a deployment script file based on firewall deployment requirement data and device information of multiple resource pool servers; calls the Ansible operation and maintenance tool to execute the deployment script file to obtain deployment execution files corresponding to the multiple resource pool servers; sends each deployment execution file to the corresponding resource pool server, so that the resource pool server deploys the firewall based on the corresponding deployment execution file; and tests each firewall when each resource pool server feeds back deployment success information. In this way, by converting the firewall deployment requirement data and the device information of multiple resource pool servers into a deployment script file, and calling the Ansible operation and maintenance tool to execute the deployment script file, batch firewall deployment for multiple resource pool servers can be achieved, thereby improving the efficiency of firewall deployment in multiple resource pools.

[0075] In an exemplary embodiment, the process of testing each firewall in the provided firewall management method includes steps 402 to 408, wherein:

[0076] Step 402, based on the firewall test requirement data, obtain a test script file.

[0077] In one possible implementation, reference Figure 2 In addition to the central node and deployment node, the management server also includes a test node. The central node obtains the test script file based on the firewall test requirement data and sends the test script file to the test node. The test node is installed with the Ansible operation and maintenance tool.

[0078] Exemplarily, the firewall test requirement data may be determined based on a test case input by a user, or may be one of a plurality of preset firewall test cases.

[0079] Among them, the firewall test requirement data includes two parts, one is the test configuration data, and the other is the test operation data.

[0080] Step 404, calling the Ansible operation and maintenance tool to execute the test script file, and obtaining the test configuration execution files and the test operation execution files corresponding to the multiple resource pool servers respectively.

[0081] In a possible implementation, the test node calls the Ansible operation and maintenance tool to execute the test script file to obtain the test configuration execution files and the test operation execution files corresponding to the multiple resource pool servers respectively.

[0082] Exemplarily, the test configuration execution file and the test operation execution file are in Python script format.

[0083] Step 406: Send each test configuration execution file to the corresponding resource pool server, so that the resource pool server configures the firewall based on the test configuration execution file.

[0084] Among them, each test configuration execution file is first sent to the corresponding resource pool server, so that the resource pool server can configure the firewall according to the test configuration file.

[0085] Exemplarily, the test node sends each test configuration execution file to the firewall management platform side of each resource pool server; after receiving the test configuration execution file, the management platform configures the corresponding test configuration to the corresponding resource pool firewall, and after the firewall returns a notification of successful configuration, the management platform feeds back the execution success instruction value test node.

[0086] Step 408, when the resource pool server feeds back the test configuration success information, the test operation execution file is sent to the corresponding resource pool server, so that the resource pool server can call the test virtual machine to test the firewall based on the test operation execution file, wherein the test virtual machine is deployed by the resource pool server based on the deployment execution file.

[0087] In this embodiment, the deployment script file includes a task of deploying a test virtual machine in a resource pool server, and the corresponding deployment execution file includes a corresponding script for deploying the test virtual machine. The resource pool server deploys not only the firewall but also the test virtual machine based on the corresponding deployment file. Exemplarily, in this embodiment, the firewall deployment requirement data also includes test virtual machine routing information.

[0088] In a possible implementation, when each resource pool server feeds back test configuration success information, each test operation execution file is sent to the corresponding resource pool server.

[0089] In another possible implementation, for each resource pool server, when the resource pool server feeds back test configuration success information, the test operation execution file is sent to the resource pool server; illustratively, when resource pool server A feeds back test configuration success information, the test operation execution file is sent to resource pool server A, and when resource pool server B does not feed back test configuration success information, the corresponding test operation execution file is not sent to resource pool server B.

[0090] In this implementation, for each resource pool server, the test configuration execution file and the test operation execution file are taken as a whole; the firewall test progress in different resource pool servers does not interfere with each other.

[0091] In the firewall management method provided in the above embodiment, in the process of testing each firewall, a test script file is obtained based on the firewall test requirement data, and the Ansible operation and maintenance tool is called to generate a test configuration execution file for configuring the firewall based on the test script file and call the test virtual machine to complete the test operation, thereby avoiding the test configuration of firewalls in different resource pools in the related technology by calling the management platform interface through the front-end input to send the configuration to the corresponding firewall, or calling the management platform interface through a script to send the configuration to the corresponding firewall. By calling the Absible operation and maintenance tool, the generation and sending of test configuration execution files and test operation execution files for firewalls in each resource pool are completed in batches, thereby improving the testing efficiency of firewalls in multiple resource pools and increasing the exposure rate of bugs.

[0092] In an exemplary embodiment, the provided firewall management method further includes steps 502 to 508, wherein:

[0093] Step 502: Receive the test results fed back by each resource pool server.

[0094] Among them, the test results may include functional test results, performance test results, and security test results.

[0095] Exemplarily, after receiving the test results fed back by each resource pool server, the management node executes the tasks corresponding to the test script file and sends the test results fed back by each resource pool server to the central node.

[0096] Step 504: When there is a test result that is the same as the expected result in each test result, analysis and processing are performed based on the abnormal test result and the normal test result to obtain a test horizontal analysis result.

[0097] Among them, each test result is calculated and compared with the expected result. If the test result is the same as the expected result, it is considered that the firewall corresponding to the resource pool has passed the test, and the test result is regarded as a normal test result; if the test result is the same as the expected result, the test result is regarded as an abnormal test result, and analyzed and processed with the normal test results corresponding to other resource pools to obtain the test horizontal analysis result.

[0098] Exemplarily, the abnormal test results and normal test results can be analyzed and compared by deep learning algorithms such as convolutional neural networks or graph neural networks to confirm whether the abnormal test results represent whether there is a bug in the deployment process of the corresponding resource pool firewall.

[0099] Step 506, analyzing and processing based on the abnormal test result and the historical test result corresponding to the abnormal server to obtain the test longitudinal analysis result; wherein the abnormal server is the resource pool server corresponding to the abnormal test result.

[0100] Exemplarily, the abnormal test result and the historical test result corresponding to the abnormal server can be analyzed and processed longitudinally through a time series neural network model such as RNN (Recurrent Neural Network) and LSTM (Long Short-Term Memory) to obtain a longitudinal analysis result of the test. Exemplarily, the normal fluctuation pattern of the abnormal server is learned based on the historical test results corresponding to the abnormal server. If the trend of the abnormal test result is significantly inconsistent with the historical test result, the abnormal test result is marked as representing a firewall failure.

[0101] Step 508: When at least one of the horizontal analysis result and the vertical analysis result indicates that the abnormal test result is a firewall failure, test abnormality alarm information is generated, and the abnormal alarm information includes the abnormal test result and resource pool information corresponding to the abnormal server.

[0102] Among them, in step 504 and step 506, the abnormal test results only represent that the test results are the same as the expected results, and do not mean that there is a real bug. When at least one of the horizontal analysis results and the vertical analysis results characterizes that the abnormal test result is a firewall failure, the abnormal test result is considered to represent the existence of a real bug. The abnormal test results and resource pool information of the corresponding resource pool are pushed to the test developer's mailbox, or the test abnormality alarm information is transmitted to the developer through other means.

[0103] The firewall management method provided in the above embodiment analyzes and processes the test results fed back by each resource pool server. When there are test results that are the same as the expected results, the firewall abnormal test data is accurately screened by comparing the normal test results corresponding to other resource pool servers and the historical test results of the abnormal server itself, which facilitates testers and R&D personnel to accurately locate bugs, reduce ineffective work, and improve testing efficiency.

[0104] In an exemplary embodiment, the provided firewall management method further includes steps 602 to 606, wherein:

[0105] Step 602, obtaining a resource recovery script file.

[0106] Exemplarily, the resource recovery script file may be pre-stored in the management server, and used to destroy the test virtual machine after the test is completed; and further exemplary, the resource recovery script may be determined based on the user's resource recovery demand data.

[0107] Step 604, when the test result is the same as the expected result, call the Ansible operation and maintenance tool to execute the resource recovery script file to obtain the resource recovery execution files corresponding to the multiple resource pool servers respectively.

[0108] Among them, if the test result is the same as the expected result, it can be considered that the resource pool firewall corresponding to the test result has passed the test and can be put into use. In order to save computing resources, the test virtual machine corresponding to the test result can be destroyed to release the corresponding computing resources.

[0109] Exemplarily, when all test results are the same as expected results, the Ansible operation and maintenance tool is called to execute the resource recovery script file.

[0110] In a possible implementation, the management server may include a recycling node in addition to the central node, deployment node, and test node, and the recycling node is installed with the Ansible operation and maintenance tool. The central node obtains the resource recycling script, and when the test results are the same as the expected test results, the resource recycling script is sent to the recycling node, and the recycling node calls the Ansible operation and maintenance tool to execute the resource recycling script file, and obtains the resource recycling execution files corresponding to the multiple resource pool servers.

[0111] Step 606: Send the resource recovery execution file to the resource pool server, so that the resource pool server can recover the computing resources corresponding to the test virtual machine based on the resource recovery execution file.

[0112] In a possible implementation, the recycling node sends the resource recycling execution file to the corresponding resource pool server, so that the resource pool server recycles the computing resources corresponding to the test virtual machine based on the resource recycling execution file.

[0113] The firewall management method provided in the above embodiment calls the Ansible operation and maintenance tool to execute the resource recovery script file, thereby destroying the test virtual machines on multiple resource pool servers in batches and improving the resource recovery efficiency.

[0114] In an exemplary embodiment, the provided firewall management method further includes steps 702 to 706, wherein:

[0115] Step 702, obtaining a monitoring script file for monitoring the operational reliability of each firewall.

[0116] For example, a monitoring script file is pre-stored on the management server. After each resource pool firewall passes the test and is put into operation, the monitoring script file is periodically obtained to monitor the operating reliability or stability of each firewall.

[0117] Exemplarily, the monitoring script file includes tasks for monitoring information such as the CPU, memory, disk, packet loss rate, and online status of the firewall.

[0118] In a possible implementation, a monitoring script file is pre-stored in the recycling node. After each resource pool firewall passes the test and is put into operation, the recycling node periodically obtains the monitoring script file.

[0119] Step 704, calling the Ansible operation and maintenance tool to execute the monitoring script file, and obtaining monitoring execution files corresponding to the multiple resource pool servers respectively.

[0120] Step 706: Send each monitoring execution file to the corresponding resource pool server, so that the resource pool server can detect the corresponding operating parameters of the firewall based on the monitoring execution file, and feedback the monitoring abnormal parameters when the operating parameters are abnormal.

[0121] Among them, the test virtual machine in the resource pool server detects the corresponding operating parameters of the firewall based on the monitoring execution file. It is necessary to query the status of each core of the CPU of the corresponding resource pool firewall, the status of the memory pool data, the disk storage space data, the firewall inbound interface bandwidth, the firewall outbound interface bandwidth, the number of concurrent sessions, the rate of new session creation and other information.

[0122] Exemplarily, when there are abnormalities in the running parameters, the resource pool server may feedback the monitoring abnormal parameters, including: if the utilization rate of a certain CPU core is greater than a threshold value within a certain period of time, the resource pool server reports the information that the CPU x utilization rate is high to the test node; if the memory data of the firewall memory pool is stably lower than a certain threshold value, it is considered that there is a possibility of memory leakage, and the resource pool server reports the information that the remaining memory of the resource pool is insufficient to the test node; if the remaining storage space of the disk is lower than a certain threshold value, the resource pool server reports the information that the disk storage space is insufficient to the test node; if the firewall inbound interface bandwidth / outbound interface bandwidth>a certain value, it is considered that the firewall processes the service abnormally and the packet loss is serious, and the resource pool server reports the corresponding data to the test node; if the number of concurrent sessions of the firewall within a certain period of time is continuously greater than a certain threshold value, it is considered that the network traffic is abnormal, and the resource pool server reports the corresponding data to the test node; if the new session creation rate of the firewall within a certain period of time is continuously greater than a certain value, it is also considered that the traffic is abnormal, and the resource pool server reports the corresponding new session creation rate number to the test node.

[0123] It should be noted that, in the embodiments where the operational reliability of the firewall needs to be monitored, the specific monitoring process is generally performed through a test virtual machine, and resources of the test virtual machine are not recycled at this time.

[0124] Step 708: Analyze and process the monitoring abnormality parameters fed back by the resource pool server.

[0125] In a possible implementation, step 708 further includes steps 802 to 806, wherein:

[0126] Step 802: Analyze and process the monitored abnormal parameters and the historical abnormal parameters corresponding to the monitored abnormal parameters to obtain the monitored longitudinal analysis results.

[0127] Step 804 , analyzing and processing the monitoring abnormality parameters and the monitoring abnormality data corresponding to other resource pool servers to obtain a monitoring horizontal analysis result.

[0128] Step 806 , when at least one of the monitoring vertical analysis result and the monitoring horizontal analysis result represents that the monitoring abnormality parameter is real abnormal data, generating monitoring abnormality alarm information, wherein the monitoring abnormality alarm information includes the monitoring abnormality parameter.

[0129] In this implementation, after receiving the monitoring abnormality parameters fed back by the resource pool server, the monitoring abnormality parameters are compared vertically and horizontally to identify the real abnormal data, so as to accurately monitor the operation status of the firewall.

[0130] The firewall management method provided in the above embodiment realizes batch monitoring of multiple resource pools to monitor the operating reliability of firewalls by calling the Ansible operation and maintenance tool to execute the monitoring script file, thereby improving the efficiency of monitoring the operating reliability of firewalls in multiple resource pools.

[0131] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0132] It is understood that the term "based on" used in this application is used to describe one or more factors that affect the determination, and does not exclude other factors that may affect the determination. For example, the phrase "determine A based on B" means that the determination of A can be based entirely or at least partially on factor B, that is, B is a factor that affects the determination of A, but does not exclude that the determination of A is also based on C.

[0133] Based on the same invention concept, please refer to Figure 2 The embodiment of the present application also provides a firewall management system, namely Figure 2 The management server 102 in the embodiment can be regarded as a firewall management system, including a central node and a deployment node;

[0134] Among them, the central node is used to obtain the deployment script file based on the firewall deployment demand data and the equipment information of multiple resource pool servers, and transmit the deployment script file to the deployment node.

[0135] The deployment node is configured with the Ansible operation and maintenance tool, which is used to call the Ansible operation and maintenance tool to execute the deployment script file, obtain the deployment execution files corresponding to the multiple resource pool servers, and send each deployment execution file to the corresponding resource pool server, so that the resource pool server deploys the firewall based on the corresponding deployment execution file;

[0136] When each resource pool server feeds back deployment success information, the central node is also used to test each firewall.

[0137] In an exemplary embodiment, the firewall management system further includes a test node; wherein,

[0138] The central node is used to obtain the test script file based on the firewall test requirement data and transmit the test script file to the test node;

[0139] The test node is configured with an Ansible operation and maintenance tool, and is used to call the Ansible operation and maintenance tool to execute a test script file, obtain test configuration execution files and test operation execution files corresponding to multiple resource pool servers, and send each test configuration execution file to the corresponding resource pool server, so that the resource pool server can configure the firewall based on the test configuration execution file; and when each resource pool server feeds back test configuration success information, each test operation execution file is sent to the corresponding resource pool server, so that the resource pool server can call a test virtual machine based on the test operation execution file to test the firewall, wherein the test virtual machine is deployed by the resource pool server based on the deployment execution file.

[0140] In an exemplary embodiment, the test node is used to receive the test results fed back by each resource pool server and send each test result to the central node. The central node is used to analyze and process based on the abnormal test results and the normal test results to obtain the test horizontal analysis result when there is a test result that is the same as the expected result in each test result, and to analyze and process based on the abnormal test results and the historical test results corresponding to the abnormal server to obtain the test vertical analysis result; wherein the abnormal server is the resource pool server corresponding to the abnormal test result, and is used to generate test abnormality alarm information when at least one of the horizontal analysis result and the vertical analysis result indicates that the abnormal test result is a firewall failure, and the abnormal alarm information includes the abnormal test result and the resource pool information corresponding to the abnormal server.

[0141] In an exemplary embodiment, the firewall management system further includes a recycling node; wherein,

[0142] The central node is also used to obtain resource recovery script files and transmit the resource recovery script files to the recovery nodes;

[0143] The recycling node is configured with the Ansible operation and maintenance tool. When the test result is the same as the expected result, the Ansible operation and maintenance tool is called to execute the resource recycling script file, obtain the resource recycling execution files corresponding to the multiple resource pool servers, and send the resource recycling execution files to the resource pool server, so that the resource pool server can recycle the computing resources corresponding to the test virtual machine based on the resource recycling execution files.

[0144] In an exemplary embodiment, the test node is also used to obtain a monitoring script file for monitoring the operating reliability of each firewall, and to call the Ansible operation and maintenance tool to execute the monitoring script file to obtain monitoring execution files corresponding to multiple resource pool servers, and to send each monitoring execution file to the corresponding resource pool server so that the resource pool server can detect the operating parameters corresponding to the firewall based on the monitoring execution file and feedback the monitoring abnormality parameters when there are abnormalities in the operating parameters, and to send the monitoring abnormality parameters to the central node.

[0145] The central node is used to analyze and process the monitoring abnormality parameters received from the resource pool server.

[0146] In an exemplary embodiment, the central node is used to perform analysis and processing based on the monitoring abnormality parameters and the historical abnormality parameters corresponding to the monitoring abnormality parameters to obtain the monitoring vertical analysis results, and is used to perform analysis and processing based on the monitoring abnormality parameters and the monitoring abnormality data corresponding to other resource pool servers to obtain the monitoring horizontal analysis results, and is used to generate monitoring abnormality alarm information when at least one of the monitoring vertical analysis results and the monitoring horizontal analysis results characterizes that the monitoring abnormality parameters are real abnormal data, and the monitoring abnormality alarm information includes the monitoring abnormality parameters.

[0147] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal device, and its internal structure diagram may be as shown in FIG. Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data that needs to be called when implementing the firewall management method. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a firewall management method is implemented.

[0148] Those skilled in the art will understand that Fig. 9The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0149] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0150] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0151] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0152] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0153] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0154] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0155] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A firewall management method, characterized in that: The firewall management method comprises: Based on the firewall deployment requirement data and the device information of multiple resource pool servers, a deployment script file is obtained; Calling the Ansible operation and maintenance tool to execute the deployment script file to obtain deployment execution files corresponding to the multiple resource pool servers respectively; Sending each of the deployment execution files to the corresponding resource pool server respectively, so that the resource pool server deploys the firewall based on the corresponding deployment execution file; When each of the resource pool servers feeds back deployment success information, each of the firewalls is tested.

2. The method according to claim 1, characterized in that The testing of each of the firewalls includes: Based on the firewall test requirement data, obtain the test script file; Calling the Ansible operation and maintenance tool to execute the test script file to obtain test configuration execution files and test operation execution files corresponding to the multiple resource pool servers respectively; Sending each of the test configuration execution files to a corresponding resource pool server, so that the resource pool server configures the firewall based on the test configuration execution file; When the resource pool server feeds back the test configuration success information, the test operation execution file is sent to the corresponding resource pool server respectively, so that the resource pool server calls the test virtual machine to test the firewall based on the test operation execution file, wherein the test virtual machine is deployed by the resource pool server based on the deployment execution file.

3. The method according to claim 2, characterized in that The method further comprises: Receive test results fed back by each of the resource pool servers; In the case that there is a test result that is the same as the expected result among the test results, analyzing and processing based on the abnormal test result and the normal test result to obtain a test horizontal analysis result; Analyze and process the abnormal test result and the historical test result corresponding to the abnormal server to obtain a longitudinal analysis result of the test; wherein the abnormal server is a resource pool server corresponding to the abnormal test result; When at least one of the horizontal analysis result and the vertical analysis result indicates that the abnormal test result is a firewall failure, test abnormality alarm information is generated, and the abnormal alarm information includes the abnormal test result and resource pool information corresponding to the abnormal server.

4. The method according to claim 3, characterized in that: The method further comprises: Get the resource recovery script file; When the test result is the same as the expected result, calling the Ansible operation and maintenance tool to execute the resource recovery script file to obtain resource recovery execution files corresponding to the multiple resource pool servers respectively; The resource recovery execution file is sent to the corresponding resource pool server, so that the resource pool server recovers the computing resources corresponding to the test virtual machine based on the resource recovery execution file.

5. The method according to claim 1, characterized in that The method further comprises: Obtaining a monitoring script file for monitoring the operational reliability of each of the firewalls; Calling the Ansible operation and maintenance tool to execute the monitoring script file to obtain monitoring execution files corresponding to the multiple resource pool servers respectively; Sending each of the monitoring execution files to the corresponding resource pool server, so that the resource pool server detects the operating parameters corresponding to the firewall based on the monitoring execution file, and feeds back the monitoring abnormal parameters if the operating parameters are abnormal; The monitoring abnormality parameters fed back by the resource pool server are analyzed and processed.

6. The method according to claim 5, characterized in that The analyzing and processing of the monitoring abnormality parameters received and fed back by the resource pool server includes: Analyze and process the monitoring abnormal parameters and the historical abnormal parameters corresponding to the monitoring abnormal parameters to obtain the monitoring longitudinal analysis results; Analyze and process the monitoring abnormality data corresponding to other resource pool servers based on the monitoring abnormality parameters to obtain a monitoring horizontal analysis result; In the case where at least one of the monitoring longitudinal analysis result and the monitoring transverse analysis result indicates that the monitoring abnormality parameter is real abnormal data, monitoring abnormality alarm information is generated, and the monitoring abnormality alarm information includes the monitoring abnormality parameter.

7. A firewall management system, characterized in that: The firewall management system comprises: The central node is used to obtain a deployment script file based on the firewall deployment requirement data and the device information of multiple resource pool servers, and transmit the deployment script file to the deployment node; The deployment node is configured with an Ansible operation and maintenance tool, and is used to call the Ansible operation and maintenance tool to execute the deployment script file, obtain deployment execution files corresponding to the multiple resource pool servers, and send each of the deployment execution files to the corresponding resource pool server, so that the resource pool server deploys the firewall based on the corresponding deployment execution file; In the case that each of the resource pool servers feeds back deployment success information, the central node is also used to test each of the firewalls.

8. The firewall management system according to claim 7, characterized in that: The firewall management system also includes a test node; wherein, The central node is used to obtain a test script file based on the firewall test requirement data, and transmit the test script file to the test node; The test node is configured with an Ansible operation and maintenance tool, which is used to call the Ansible operation and maintenance tool to execute the test script file, obtain test configuration execution files and test operation execution files corresponding to the multiple resource pool servers, and send each of the test configuration execution files to the corresponding resource pool server, so that the resource pool server can configure the firewall based on the test configuration execution file; and when each of the resource pool servers feeds back test configuration success information, each of the test operation execution files is sent to the corresponding resource pool server, so that the resource pool server can call the test virtual machine based on the test operation execution file to test the firewall, wherein the test virtual machine is deployed by the resource pool server based on the deployment execution file.

9. The firewall management system according to claim 8, characterized in that: The firewall management system also includes a recycling node; The central node is further used to obtain a resource recovery script file and transmit the resource recovery script file to the recovery node; The recycling node is configured with an Ansible operation and maintenance tool, which is used to call the Ansible operation and maintenance tool to execute the resource recycling script file when the test result is the same as the expected result, obtain the resource recycling execution files corresponding to the multiple resource pool servers respectively, and send the resource recycling execution files to the resource pool server, so that the resource pool server can recycle the computing resources corresponding to the test virtual machine based on the resource recycling execution files.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

Images