Network management using servers in central computer system and server agents in local branch network

Abstract

Embodiments of the present disclosure relate to network management using a server at a central computer system and a server proxy at a local branch network. A process includes establishing, by a local activation server agent of a first local branch computer network, a first connection with an activation server of a central computer system. The activation server manages network device authentication information corresponding to a plurality of local branch computer networks including a first branch local computer network. The process includes communicating, by a local activation server proxy, with a central activation server over a first connection to receive network device authentication information for a given network device associated with an entity associated with a first local branch computer network. The process includes establishing a second connection between the given network device and the locally active server agent in response to the given network device being connected to the first local branch computer network. The process includes authenticating, by the local activation server agent, the given network device based on network device authentication information for the given network device. The verification includes the local activation server agent communicating with the given network device over the second connection.

Description

Background Art

[0001] When a network device (eg, a network switch) is first connected to a network, the onboarding process authenticates the network device and configures the network device to communicate with the network. Zero Touch Provisioning (ZTP) is an automated onboarding process that involves no user assistance. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Figure 1 is a block diagram of a computer network with a hybrid network management solution including cloud-based servers and local server agents according to an example implementation.

[0003] Figure 2 is a sequence flow diagram illustrating communications associated with launching a local activation server agent of a hybrid network management solution according to an example implementation.

[0004] Figure 3 is a sequence flow diagram illustrating communications associated with initiation of a local central server agent of a hybrid network management solution according to an example implementation.

[0005] Figure 4 is a sequence flow diagram illustrating communications for onboarding a network device using a local activation server agent and a local central server agent of a hybrid network management solution according to an example implementation.

[0006] Figure 5 is a sequence flow diagram illustrating communications between a local central server agent and a central server of a hybrid network management solution for managing network devices according to an example implementation.

[0007] Figure 6 is a sequence flow diagram illustrating communications between components of a hybrid network management solution related to upgrading firmware of a network device according to an example implementation.

[0008] Figure 7 is a flow chart depicting a process for authenticating a network device using a central activation server and a local activation server agent according to an example implementation.

[0009] Figure 8 is a block diagram of a system according to an example implementation that includes a local activation server agent for authenticating a network device using information obtained from a central activation server.

[0010] Fig. 9 is an illustration of machine-readable instructions that correspond to a local activation server agent and that, when executed by a machine, cause the machine to authenticate a network device using information obtained from a central activation server, according to an example implementation. DETAILED DESCRIPTION

[0011] A commercial enterprise may use a specific network management solution to manage its network devices. In this context, "managing" a network device means managing any operational aspect of the network device. In one example, managing a network device may include loading the network device. In another example, managing a network device may include configuring the network device. In another example, managing a network device may include monitoring network telemetry metrics associated with or provided by the network device. In another example, managing a network device may include upgrading the firmware of the network device.

[0012] On-premises network management solutions may be suitable for smaller-scale computer networks (e.g., a single local area network). As the name implies, all components of an on-premises network management solution may be located in a local network containing managed network devices. For example, the software components of an on-premises network management solution may be hosted on one or more nodes (e.g., bare metal servers) of a computer network containing managed network devices. Cloud-based network management solutions may be more suitable for relatively larger computer networks. For example, an enterprise may have multiple local branch networks connected to a wide area network (WAN) (e.g., the Internet). As the name implies, the software and hardware resources of a cloud-based network management solution may be located in the cloud, and therefore, the resources may be remotely deployed relative to the network devices managed by the solution. Compared to on-premises network management solutions, cloud-based network management solutions may be highly scalable, which allows the solution to be customized based on the number of network devices and specific network infrastructure. In addition, cloud-based network management solutions provide enterprises with the ability to manage network devices of multiple branch networks from a single dashboard.

[0013] In one example, a cloud-based network management solution may be packaged as a subscription-based software as a service (SaaS) that is provided by two main cloud-based components: a remote activation server and a remote central server. The remote activation server holds the licenses and subscriptions for the managed network devices, and the remote activation server authenticates the network devices when they are first connected to the network. The remote central server manages other operational aspects of the network devices, including the central server forwarding user-provided configuration data (e.g., configuration files) to the network devices and providing versioned firmware images to the network devices for firmware upgrades. The remote central server may also perform management services, such as monitoring network telemetry data provided by the managed network devices; identifying network device failures and performance issues based on the network telemetry data; and overseeing remedial actions to resolve network device failures and / or performance issues.

[0014] Cloud-based network management solutions may face certain challenges that local network management solutions do not encounter. For example, for cloud-based network management solutions, each managed network device may have a network socket connection with a central server, potentially generating hundreds to thousands of network socket connections between the network device and the remote central server (depending on the number of managed network devices). Such a large number of network socket connections may contribute significantly to the overhead of the remote central server. In another example, a large amount of network telemetry data from network devices may be continuously processed on a large scale in the cloud for all managed network devices, which may degrade performance (e.g., introducing delays in the appropriate network telemetry data displayed to the user). The management abstraction introduced by the cloud-based network management solution may bring other challenges. For example, the abstraction may blur the troubleshooting visibility of the system administrator. As a more specific example, in order to solve the connection problem of the network device, the abstraction may blur the identification of whether the connection problem is due to a connection problem (e.g., the network device has the wrong IP address of the remote central server), a verification failure (e.g., the network device does not have the correct credentials or has not yet registered with the subscription account), or other reasons. Furthermore, due to the abstraction, the system administrator may not be able to identify whether the connection problem corresponds to a problem associated with the remote activation server or a problem associated with the remote central server.

[0015] According to the example implementation described herein, a hybrid network management solution includes an on-premises or local network management component and a remote central (e.g., cloud-based) network management component. Compared to a central network management solution, the hybrid network management solution significantly reduces the number of network connections to managed network devices. Due to the local collection and caching of network telemetry data, the hybrid network management solution reduces the amount of network telemetry data transmitted to a remote central server and correspondingly improves the performance of telemetry monitoring (e.g., reduces overhead time). In addition, unlike a central network management solution, a hybrid network solution provides local network visibility to enhance troubleshooting capabilities. In addition, unlike a local network management solution, a hybrid network management solution has cloud-based resources that can be appropriately scaled to accommodate the number of managed network devices and / or corresponding network infrastructure, and system administrators can use a single dashboard to manage a group of network devices distributed between multiple local branch networks.

[0016] According to an example implementation, the remote central component of the hybrid network management solution includes a remote activation server (e.g., a cloud-based activation server) and a remote central server (e.g., a cloud-based central server). The managed network devices may be included in one or more local branch networks. According to an example implementation, each local branch network includes a local agent corresponding to and communicating with the remote central component. More specifically, according to an example implementation, each local branch network includes a local activation server agent corresponding to and communicating with the remote activation server, and each branch network includes a local central server agent corresponding to and communicating with the remote central server. For high availability (HA), each branch network may include multiple local activation server agents (corresponding to and communicating with the remote activation server) and multiple local central server agents (corresponding to and communicating with the remote central server) hosted by multiple local computing nodes.

[0017] According to an example implementation, before any network device first connects to a local branch network, the local agent starts up and establishes a secure connection with its corresponding cloud-based remote peer. As part of the startup, the local activation server agent retrieves subscription and licensing information for a set of potential network devices that can connect to the local branch network. In one example, this set of potential network devices can include network devices whose identifiers have been registered in the corresponding subscription but have not yet been onboarded to any branch network associated with the subscription.

[0018] According to an example implementation, when a network device is first connected to a local branch network, the network device receives connection details (e.g., an Internet Protocol (IP) address) of a local activation server agent from a local Dynamic Host Control Protocol (DHCP) server. Using these connection details, the network device contacts the local activation server agent and requests to establish a connection with the local activation server agent. The local activation server agent can then authenticate the network device. After successful authentication, the local activation server agent provides the network device with connection details (e.g., an IP address and a digital certificate) of the local central server agent.

[0019] According to example implementations, the local central server agent and its other functions act as a message broker between the managed network devices and the remote central server. According to some implementations, the local central server agent has a single secure connection with the central server. The managed network devices send management-affiliated messages (e.g., messages containing network telemetry content) to the local central server agent, and the local central server agent merges or groups these messages into a collection of one or more messages, which are sent to the central server by the local central server agent through a single secure connection between the agent and the remote central server. In addition, according to example implementations, the local central server agent demultiplexes or separates the merged management-affiliated messages (e.g., messages containing configuration files) received from the remote central server into messages that are routed to the corresponding managed network devices. Therefore, due to the message multiplexing and demultiplexing performed by the central server agent, the number of network connections between the local central agent and the remote central server is minimized and is independent of the number of managed network devices.

[0020] In addition to its other features, the local central server agent can maintain a local database that is synchronized with the central database managed by the remote central server. In one example, the local database can store information such as data representing an inventory of managed network devices and data representing the last known good configuration of the managed network devices. In addition, according to some implementations, when a newer firmware image becomes available, the local central server agent can preemptively retrieve a newer version of the firmware image of the managed network device. The local central server agent can store the retrieved firmware image in a local firmware repository managed by the local central server agent. Preemptively downloading the firmware image to the local repository accelerates future firmware upgrades of the managed network device.

[0021] refer to Figure 1 As a more specific example, according to some implementations, a hybrid network management solution implemented in a computer network 100 manages network devices 114 ( Figure 1 1 to 110-N of the computer network 100 are shown in FIG. 1 ). The hybrid network management solution includes remote central components of the central computer system and local components of the local branch network 110. Figure 1 In the example implementation shown, the central computer system is a cloud-based remote central cloud system 180 that includes the cloud-based remote components of the hybrid network management solution.

[0022] In the context used in this article, "remote" and "local" are relative terms that specify whether an entity or service is located in the same or different networks. In one example, the local network can be a private network. In one example, the remote network can be a private network in the cloud. In the context used in this article, a "local branch" network is a network that is associated with a specific geographic location and communicates with one or more other networks through a network structure. A local branch network may also be referred to as a "local branch computer network" or a "local network." In one example, a local branch network may be a local area network (LAN). In an example, a local branch network may be a network corresponding to a specific building, group of buildings, or campus. In one example, a local branch network may correspond to an edge computer system. In another example, a local branch network may correspond to a system of Internet of Things (IoT) devices (e.g., sensors, controllers, cameras, or other devices). In another example, a local branch network may correspond to an edge system.

[0023] In this context, a "central computer system" refers to a computer system that coordinates activities associated with multiple local branch computer networks. The central computer system can be remote in that components of the central computer system are not located in the same local branch network 110 as the managed network devices 114. In one example, the central computer system and the local branch networks can be part of a WAN. In one example, the central computer system can be a distributed system of hardware and software that communicates with the local branch networks over a WAN structure. In one example, the central computer system can be a cloud-based system with software and hardware that can be distributed across one or more computer racks, one or more data centers, and one or more availability zones. In one example, the central computer system can provide cloud-based services, such as SaaS.

[0024] In this context, a "cloud-based" entity (such as a cloud-based server) refers to a unit of distributed hardware and software systems that is accessed through a wide area network (such as the Internet). In one example, a cloud-based server can be virtual (e.g., can correspond to one or more virtual machines) and hosted on one or more computer platforms (e.g., blade servers or rack servers). In an example, a cloud-based entity can be part of a public cloud, a private cloud, or a hybrid cloud.

[0025] In the following implementations described herein, the central components of the hybrid network management solution are assumed to be cloud-based remote components that are disposed in a remote central cloud system. However, it is noted that, according to other implementations, the central components of the hybrid network management solution may be located in a remote central computer system other than a cloud-based computer system (e.g., a dedicated computer system of an enterprise).

[0026] although Figure 1 Specific local components of the hybrid management solution are depicted for an exemplary branch network 110-1, but other branch networks 110 may have similar local components. Depending on the particular implementation, the local branch networks 110 may have many different architectures or forms. In addition, the local branch networks 110 may correspond to the same type of network or be associated with different types of networks (e.g., the branch networks 110 may include a mix of campus, data center, and IoT networks). According to some implementations, a given local branch network 110 may be associated with a subscription to a network management service (provided by the hybrid network management solution) and associated with a particular subscription account holder. In addition, according to some implementations, multiple branch networks 110 may be associated with the same subscription and, accordingly, associated with the same subscription account holder.

[0027] The cloud-based components of the hybrid network management solution include a remote activation server 184 and a remote central server 188. The remote activation server 184 manages data representing subscriptions to the hybrid network management solution and network device licensing information. In one example, a subscription can be associated with a corresponding user account, and each subscription can provide licensing for up to a predetermined number of registered network devices 114. In one example, a user (e.g., a system administrator) can register a particular network device 114 for a particular subscription (e.g., via a media access control (MAC) address or other network device identifier).

[0028] According to some implementations, remote activation server 184 can generate data to drive a user interface through which a system administrator associated with a particular subscription account holder can view and update subscription and licensing information. In one example, the user interface can be a web-based graphical user interface (GUI) that can be accessed by a system administrator through an Internet browser hosted on management node 198.

[0029] According to an example implementation, the remote central server 188 can perform various management services for the managed network devices 114. In one example, the remote central server 188 can provide configuration data (e.g., a configuration file) related to network device loading. In another example, the remote central server 188 can monitor network telemetry data. In another example, the remote central server 188 can identify potential or actual network device failure issues. In another example, the remote central server 188 can identify potential or actual network performance issues. In another example, the remote central server 188 can oversee remedial measures to correct network problems. In another example, the remote central server 188 can provide firmware images. For such purposes, the remote central server 188 hosts the monitoring application 190 and the central application 192.

[0030] According to an example implementation, the monitoring application 190 receives and processes network telemetry data (e.g., messages) provided by the network device 114. In this context, "network telemetry data" generally refers to information or content that represents information from which insights into the state of a network, a network device, or a client device connected to the network device can be determined directly or indirectly. The network telemetry data can be specifically requested from (or "pulled from") the network device 114 (e.g., provided in response to a request from the monitoring application 190) or provided (or "pushed") by the network device 114 to the monitoring application 190 without a specific request.

[0031] In one example, network telemetry data may include periodic measurement statistics of network or network device metrics or measurements. In one example, statistics may be the traffic volume of a specific sampling period (e.g., the traffic volume of a specific VLAN). In other examples, statistical data may be periodically measured egress bandwidth, ingress bandwidth, latency, round trip time, or resource usage or host activity. In other examples, network telemetry data may represent the value of a counter of a network device, a configuration setting of a network device, an event log of a network device, a state snapshot of a network device, a configuration snapshot of a network device, or other information about a network device. Network telemetry data may represent an event. In one example, a network device may send a network telemetry message that is triggered by certain change events (e.g., a network telemetry message triggered by a network device sending a disassociation message). Typically, network telemetry data may represent information about the control, management, and / or data plane of a network.

[0032] The processing of network telemetry data by the monitoring application 190 can take various different forms. In one example, the monitoring application 190 can generate data based on the network telemetry data to graphically represent network telemetry metrics, network tracking, statistics, or other network-related information on a user interface. In another example, the monitoring application 190 can record network telemetry data and / or record network telemetry events. In another example, the monitoring application 190 can process network telemetry data to identify network problems. In one example, the monitoring application 190 can predict the failure or poor performance of a network device 114, another network component (e.g., a server), or a network subnet based on the network telemetry data. In another example, the monitoring application 190 can identify the actual failure or poor performance of a network device 114, another network component, or a network subnet based on the network telemetry data. In another example, the monitoring application 190 can identify a suboptimal configuration of a network device based on the network telemetry data. According to some implementations, the identification and / or prediction of network problems by the monitoring application can be assisted in whole or in part by one or more machine learning models. In one example, a specific machine learning model can be a supervised or unsupervised model. According to some implementations, the monitoring application's identification of network problems may be aided in whole or in part by one or more knowledge databases that correlate problems with observed network telemetry metrics.

[0033] According to some implementations, the monitoring application 190 can provide recommended solutions for the identified network problems. In one example, the recommendation is a recommended reconfiguration of one or more network devices 114. In another example, the recommendation can be a recommended reconfiguration of a specific network subnet. In another example, the recommendation can be a recommended replacement or upgrade of one or more network devices 114. In another example, the recommendation can be a recommended firmware upgrade for a specific network device 114 or a group of network devices 114. According to some implementations, the recommendations of the monitoring application can be facilitated in whole or in part by one or more machine learning models (e.g., supervised or unsupervised models). According to some implementations, the recommendations of the monitoring application can be facilitated in whole or in part by one or more knowledge databases that associate recommendations with specific network problems.

[0034] According to some implementations, the monitoring application 190 can generate data to drive a user interface (e.g., a web-based GUI viewed through an Internet browser), such as a dashboard viewed on the management node 198. Through the dashboard, for example, a system administrator can view network performance and network problems from all branch networks 110 associated with a particular user account.

[0035] According to an example implementation, the central application 192 can generate data to drive a user interface (e.g., a web-based GUI viewed through an Internet browser) through which a system administrator (via the management node 198) affiliated with a particular account holder can take actions to initiate various management-affiliated actions. In one example, as part of the onboarding of a network device 114, an administrator can upload one or more configuration files to be installed on a particular network device. In another example, an administrator can initiate a reconfiguration of a network device 114. In another example, an administrator can approve a solution recommended by the monitoring application 190 for resolving a particular network problem. In another example, an administrator can initiate a firmware upgrade for a particular network device.

[0036] According to an example implementation, the hybrid network management solution includes local components located in the branch network 110. Figure 1 As shown, for the branch network 110-1, these local components include a local activation server agent 118 and a local central server agent 130. According to an example implementation, the local activation server agent 118 retrieves user account subscription information 120 from the remote activation server 184 via a single secure connection 119 with the remote activation server 184. The user account subscription information 120 is associated with a permitted network device 114 that is or can be loaded into the branch network 110-1. As further described herein, the local activation server agent 118 is discovered by the newly connected network device 114; authenticates the network device 114 based on the user account subscription information 120 and possibly other criteria; and, for the successfully authenticated network device 114, provides the network device 114 with connection details of the local central server agent 130.

[0037] The local central server proxy 130 and its other functions (described further herein) allow the use of a single secure network connection with the central server 188 ( Figure 1 131 in the dashed line 131 in the diagram (shown as a dashed line in the diagram) to manage messaging between the network device 114 and the central server 188. A single network connection 131 advantageously reduces overhead on the central server 188 (as opposed to, for example, a network connection for each network device 114).

[0038] According to an example implementation, the central cloud system 180 is connected to the network fabric 164, and each local branch network 110 can be connected to the network fabric 164 through a corresponding gateway 160. The network fabric 164 can be associated with one or more types of communication networks, such as (as examples) a Fibre Channel network, a Compute Express Link (CXL) fabric, a dedicated management network, a local area network (LAN), a WAN, a global network (e.g., the Internet), a wireless network, or any combination thereof.

[0039] for Figure 1 In the illustrated example implementation, the branch network 110-1 includes a network device 114 ( Figure 1 1 through 114 -M) are shown in FIG. 1 . The network devices 114 may alternatively be referred to herein as “managed network devices” because the network devices 114 are managed by a hybrid network management solution.

[0040] In the context used in this article, "network device" refers to an actual or physical electronic component that enables data communication between other components. In one example, a network device can be a switch that operates at the second level (L2) of an open system interconnection (OSI) model to connect components of a computer network together. In another example, a network device can be a third level (L3) switch that connects two components of a computer network together and connects a computer network together. In other examples, a network device can be a component, a processor device, a network interface controller (NIC) or a structure switch including one or more devices in the above-mentioned devices of a gateway, a multicast router, a bridge, a Z generation or a computing high-speed link (CXL) network. A network device can be a wired or wireless device.

[0041] The number of network devices 114 onboarded to the branch network 110-1 may be less than the number of network devices registered to cover a particular subscription for the branch network 110-1. In one example, this difference may be at least partially due to other network devices registered for the subscription onboarded in one or more other branch networks 110. In another example, this difference may be at least partially due to other network devices registered for the subscription but not onboarded.

[0042] According to an example implementation, the network device 114 participates in an onboarding process when first connected to the branch network 110-1. In this context, an "onboarding process" refers to a series of events that, if successful, configure the network device 114 to communicate with other devices of the branch network 110. Furthermore, a result of successful onboarding of the network device 114 may be that the network device 114 may communicate with devices outside of the branch network 110.

[0043] According to an example implementation, the onboarding process may be a ZTP process (or "ZTP onboarding process" or "ZTP onboarding"). For the following example, ZTP onboarding of the network device 114-2 is discussed, with the understanding that other network devices 114 may be onboarded in a similar manner. In one example, ZTP onboarding of the network device 114-2 may be initiated or triggered when the network device 114-2 is fully powered on and connected to a component associated with the branch network 110-1 (e.g., a network switch, a top-of-set (ToR) switch, a chassis controller, or a gateway 160) via a network cable. In another example, the network device 114-2 may be a wireless device that wirelessly connects to the branch network 110-1 to initiate onboarding of the network device 114-2.

[0044] In an example of ZTP loading, the network device 114-2 can be a DHCP client. When the network device 114-2 first connects to the branch network 110-1 and sends a DHCP discovery request, the DHCP server 104 of the branch network 110-1 responds to the DHCP discovery request with a message that includes the IP address of the network device 114-2 and one or more DHCP options. According to an example implementation, the DHCP server 104 can provide a DHCP option that identifies connection information for the local activation server agent 118. In one example, the connection information can be an IP address of the local activation server agent 118. In one example, the connection information can be a digital credential that corresponds to the local activation server agent 118 and can be used by the network device 114-2 for various purposes, such as providing a credential that allows the local activation server agent 118 to authenticate the network device 114-2.

[0045] The DHCP server 104 may provide one or more DHCP options in addition to the connection information to the local activation server agent 118. In one example, the DHCP option may be the IP address of the gateway 160. In another example, the DHCP option may be the IP address of a domain name service (DNS) server. In another example, the DHCP option may be the IP address of a network time protocol (NTP) server. In another example, the DHCP option may be an identification of a minimum version firmware image of the network device 114-2, and another DHCP option may be the IP address of a simple file transfer protocol (TFTP) server, from which the network device 114-2 may retrieve a firmware image that complies with the minimum firmware image if it does not comply. In another example, the DHCP option may identify a configuration file from which settings (e.g., NTP settings, SNMP settings, DNS settings, sflow settings, or other settings) of the network device may be retrieved, and the IP address of the server that provides the configuration file may be found.

[0046] The network device 114-2 provides a connection request to the local activation server agent 118 using the connection information provided by the DHCP server 104. As part of the ZTP onboarding process, according to an example implementation, the network device 114-2 provides the connection request to the local activation server agent 118. In response to the connection request, the local activation server agent 118 verifies the network device 114-2. The verification may involve the local activation server agent 118 considering any of a number of different criteria. In one example, the criterion may be whether the network device 114-2 possesses a pre-shared key corresponding to a pre-shared key possessed by the local activation server agent 118. In one example, the criterion may be whether the network device 114-2 has a specific digital credential. In one example, the criterion may be whether the identifier (e.g., MAC address) of the network device 114-2 is on a list of MAC addresses associated with a subscription corresponding to the local network branch 110. In this manner, the local activation server agent 118 may check the identifier (e.g., MAC address) of the network device 114-2 against the user account subscription information 120. In one example, the criterion may be whether the device type of network device 114 is compatible with the architecture or configuration of local branch network 110. In one example, the criterion may be whether the version or model of network device 114-2 is compatible with the configuration or architecture of local branch network 110 (e.g., considering whether network device 114-2 corresponds to a minimum version that supports certain features).

[0047] In response to the local activation server agent 118 successfully authenticating the network device 114-2, a connection 115 may then be formed between the local activation server agent 118 and the network device 114-2. Using the connection 115, the local activation server agent 118 may then send data representing the connection details of the local central server agent 130 to the network device 114-2. In one example, the connection details may include an IP address and a digital credential of the local server agent.

[0048] In response to receiving the connection details of the local central server agent 130, the network device 114-2 may then send a connection request to the local central server agent 130. After the local central server agent successfully authenticates the network device 114-2, a secure connection 129 may be formed between the local central server agent 130 and the network device 114-2.

[0049] According to some implementations, the local central server agent 130 includes a message broker 135 that provides a streamlined message queue service for handling message traffic transmitted between the network device 114 and the remote central server 188. In this context, a "message broker" generally refers to an entity that allows different entities (e.g., instances, services, and systems) to communicate with each other. Typically, a message broker can perform message validation, format conversion, and message routing between different entities. The message broker 135 can use any of a variety of different message protocol standards, such as Kafka, Message Queuing Telemetry Transport (MQTT), Apache, RabbitMQ, or other message protocol standards.

[0050] like Figure 1 As shown, according to some implementations, the message broker 135 may include multiple transmission queues 138 and multiple reception queues 136. In one example, the reception queue 136 may be associated with the corresponding network device 114 and may temporarily store transient data representing messages received from the remote central server 188. In one example, the transmission queue 138 may be associated with the corresponding network device 114 and may temporarily store transient data representing messages sent by the corresponding network device 114 to the remote central server 188.

[0051] According to an example implementation, the local central server agent 130 accumulates messages sent by the network device 114 to the central server 188 in the transmission queue 138. When triggered, the local central server agent 130 merges the messages from all transmission queues 138 (thereby emptying the transmission queue 138) and sends the message to the central server 188 via a secure connection (connected by the network device 114). Figure 1 The message broker 135 may be configured to send one or more messages containing the content of the message sent by the network device 114 (represented by the dashed path 131 in FIG. 1 ). In one example, the trigger for merging and sending the data may correspond to the time of a predefined schedule. In another example, the trigger may be a full state or near full state (e.g., a certain percentage or queue full level) of any of the transmission queues 138. In another example, the trigger may be generated in response to a metric indicating the full state of the transmission queue. In another example, the trigger may be based on the maximum waiting time that data is in the transmission queue 138. According to another implementation, the message broker 135 may trigger the sending of a message to the central server 188 based on one or more other criteria.

[0052] According to an example implementation, the remote central server 188 sends messages for all network devices 114 of the branch network 110-1 through a single secure connection 131 with the local central server proxy 130. The message broker 135 classifies messages received from the remote central server 188 by placing the messages in the appropriate receive queue 136 before forwarding them to the appropriate network device 114.

[0053] like Figure 1 As shown, according to an example implementation, the cache 132 can be located between the local central server proxy 130 and the gateway device 160. The cache 132 facilitates fast data retrieval and synchronization. In one example, the cache 132 can be an in-memory data store, such as a Redis in-memory data store or other data store.

[0054] According to some implementations, the local central server agent 130 may maintain a local database 140 that mirrors a database (not shown) maintained by the remote central server 188. In one example, the local database 140 may store data representing the last known good state of each of the network devices 114. In another example, the local database 140 may store data representing the latest configuration state of each of the network devices 114. In another example, the local database 140 may store data representing the latest telemetry data provided by each of the network devices 114. In another example, the local database 140 may store data representing solutions or diagnostics provided by the central application 192 for the network devices 114. The local central server agent 130 and the remote central server 188 may transmit messages over the secure connection 131 for transmitting changes made to either party's database and ensuring that the data stored in the two databases is consistent.

[0055] like Figure 1 As shown, according to an example implementation, the local central server agent 130 can maintain and use a firmware library 142. The firmware library 142 generally stores firmware images that can be used to upgrade the firmware of the network device 114.

[0056] According to some implementations, the local central server agent 130 can preemptively download the firmware image from the remote central server 188. In this context, the local central server agent 130 "preemptively downloads" the firmware image means that the local central server agent 130 retrieves the firmware image from the remote central server 188 without first being requested to use the firmware image to perform a corresponding firmware upgrade on a specific network device 114.

[0057] In one example, the preemptive download of firmware images for a particular network device 114 or a group of network devices 114 may be controlled by a particular policy. In one example, the policy may specify that the local central server agent 130 retrieves a firmware image when available that corresponds to a newer firmware version than the firmware currently installed on the network device 114, and stores the retrieved firmware image in the firmware repository 142. In one example, the policy may allow a certain number of newer versions of firmware images to be retained in the firmware repository 142, so that when the firmware of a particular network device 114 is to be upgraded, multiple firmware upgrade options are available to choose from (e.g., selections made by a system administrator). In one example, a particular firmware image may correspond to multiple network devices 114. When the firmware of a network device 114 is to be upgraded, preemptive download of the firmware image accelerates its retrieval; in addition, due to the local availability of the firmware image, firmware verification and updates can be smoother and faster.

[0058] In addition to its other features, according to some implementations, the local central server agent 130 can provide a troubleshooting remote user interface that allows the system administrator to diagnose and manage any problems with the local components of the hybrid network management solution. In one example, the local central server agent 130 can provide a virtual private network (VPN) server connection that allows a VPN client (e.g., a VPN client of the management node 198) to access the branch network 110-1 for troubleshooting purposes. In addition, according to an example implementation, the local activation server agent 118 can provide a troubleshooting remote user interface (e.g., a VPN server interface) for allowing the system administrator to troubleshoot problems associated with the local activation server agent 118.

[0059] According to some implementations, activation server 184 and central server 188 may correspond to machine-readable instructions (or "software") executed on one or more nodes of central cloud system 180. In the context used herein, a "node" refers to a processor-based entity with an associated set of hardware and software resources. In one example, a "node" may be a computer platform. In this context, a "computer platform" is a processor-based electronic device that has an associated operating system. For example, a computer platform may be a rack-mounted server or a blade server. In another example, a "node" may be virtualized. For example, according to some implementations, a node may include an abstraction of the hardware and software resources of a physical computer platform (such as a virtual machine).

[0060] According to some implementations, the remote central cloud system 180 may include multiple remote activation servers 184 and multiple remote central servers 188. In one example, different pairs of remote activation servers 184 and remote central servers 188 may form corresponding network management clusters. In this way, according to some implementations, a network management cluster of a set of branch networks 110 may include remote activation servers 184; remote central servers 188; local central server agents 130 located in the set of branch networks 110; local activation server agents 118 located in the set of branch networks 110; and network devices 114 located in the set of branch networks 110.

[0061] According to an example implementation, in order to provide high availability (HA), multiple local central server agents 130 and multiple local activation server agents 118 can be located in the same branch network 110. Figure 1 As shown, the branch network 110-1 includes a plurality of local central server agents 130. In one example, the local central server agent tasks may be distributed among the plurality of local central server agents 130 of the HA group. In one example, each local central server agent may be assigned to a particular group of network devices 114 and handle the central server agent tasks for the network devices 114 of the assigned group. Continuing with the example, if a particular local central server agent 130 of the HA group fails, the responsibilities of the failed local central server agent 130 may fail over to the remaining active local server agents 130 of the HA group. In a similar manner, according to some implementations, in order to provide HA, the branch network 110-1 may include a plurality of local server agents 118 forming a HA group. In one example, the activation server agent tasks may be distributed among the local activation server agents 118 of the HA group. In one example, each local activation server agent 118 may be assigned to a particular group of network devices 114 and handle the authentication of the network devices 114 of the assigned group. Continuing with the example, if a particular local activation server agent 118 of the HA group fails, the responsibilities of the failed local activation server agent 118 may fail over to the remaining active local activation server agents 118 of the HA group.

[0062] According to an example implementation, the local components of the hybrid network management solution may be hosted by a node of the branch network 110. Figure 1 As shown, for the branch network 110-1, a given local central server agent 130 may be associated with a set of machine-readable instructions (or "software") that execute on one or more nodes 147 of the branch network 110-1. In addition, according to an example implementation, a given local activation server agent 118 may include a set of machine-readable instructions that execute on one or more nodes 147 of the branch network 110-1.

[0063] A given node 147 may be physical or virtual. Regardless of its specific form, a node 147 may be associated with one or more hardware processors 148 and memory 149. A hardware processor 148 is a physical or actual processor that executes machine-readable instructions (e.g., software or firmware instructions). In an example, the processor 148 may include one or more central processing unit (CPU) cores, or one or more graphics processing unit (GPU) cores. Memory 149 is a non-transitory storage medium that may be formed by a semiconductor storage device, a memristor-based storage device, a magnetic storage device, a phase change memory device, a combination of devices of one or more of these storage technologies, and the like. Memory 149 may represent a collection of memories of both volatile memory devices and non-volatile memory devices. According to some implementations, one or more nodes 147 may be hosted on a specific physical computer platform, such as a bare metal server, a server blade, a rack server, or another computer platform of a branch network 110-1.

[0064] According to an example implementation, before any network device 114 is connected or loaded to the branch network 110-1, the local components of the hybrid network management solution are first installed and started. According to an example implementation, the first local component started is the local activation server agent 118. Figure 2 Depicted is a sequence flow diagram 200 illustrating communications associated with launching a local activation server agent according to an example implementation.

[0065] refer to Figure 2 In response to the local activation server agent 118 being started, the local activation server agent 118 sends a connection request to the remote activation server 184, as shown at 204. In response to the connection request 204, the remote activation server 184 sends a credential request to the local activation server agent 118, as shown at 208. In one example, the credential request 208 can request the local activation server agent 118 to provide information (e.g., a digital credential) that is used to authenticate that the local server agent 118 is affiliated with the remote activation server 184 and is affiliated with a particular branch network. As shown at 212, the local activation server agent 118 can then respond with the credential, and in response to the remote activation server 184 verifying the credential, an authenticated, secure connection can then be established between the local activation server agent 118 and the remote activation server 184, as shown at 216.

[0066] Using the secure connection 216, the remote activation server 184 may then provide the user account subscription information to the local activation server agent 118, as shown at 220. In one example, the remote activation server 184 may examine the subscription corresponding to the particular branch network containing the local activation server agent 118 to identify network devices that are affiliated with the subscription and have not yet been onboarded, and provide data representing these network devices to the local activation server agent 118 (as part of the user account subscription information 220). In one example, the information 220 may include information representing an identifier (e.g., a MAC address) of the network device.

[0067] According to an example implementation, the local activation server agent 118 can then open a user interface that can be used by the management node device 198 to resolve the problem locally. In this manner, the system administrator can communicate with the local activation server agent 118 via the management node 198 to establish a secure connection 230 (as shown at 224 and 228) with the user interface.

[0068] According to an example implementation, the local central server agent 118 may be started after the local activation server agent is started. Figure 3 Depicted is a sequence flow diagram 300 showing communications associated with startup of a local activation server agent 118. In one example, the local activation server agent 118 may monitor a particular network port for discovery communications from the local central server agent 130, indicating that the local central server agent 130 is undergoing a startup process.

[0069] refer to Figure 3 According to the sequence flow chart 300, the local central server agent 130 first provides a connection / discovery request, as shown at 304. The local activation server agent 118 can then observe the connection request 304 (e.g., observe the request 304 at a particular network port), and in response to the request 304, provide a credential request, as shown at 308. Figure 3 As further shown, the local central server agent 130 provides a response to the credential request containing the credential, as shown at 312. Then, as shown at 317 and 318, the local central server agent 130 and the local activation server agent 118 can create a secure connection 319 between the agents 118 and 130.

[0070] The local activation server agent 118 may then send the connection information of the central server 318 using the secure connection 319, as shown at 320. The local central server agent 130 may then provide a connection request with credentials to the remote central server 188, as shown at 324. Then, as shown at 326 and 328, the remote central server 188 and the local central server agent 130 may create a secure connection 330 between the remote central server 188 and the local central server agent 130. According to an example implementation, over this single secure connection 330, the remote central server 188 and the local central server agent 130 may transmit messages between the remote central server 188 and a set of managed network devices.

[0071] Figure 4 A sequence flow chart 400 illustrating onboarding of a network device 114 according to an example implementation is depicted. According to an example implementation, the onboarding process may be a ZTP onboarding process. Figure 4 For example, the onboarding may be preceded by the management node 198 uploading configuration data (e.g., firmware images, configuration files, or other configuration information) to the central application 192, as shown at 401. The uploading of the configuration data may occur during or after the onboarding of the network device 114, depending on the particular implementation. In addition, according to an example implementation, before the onboarding begins, the local central server agent 130 may update the local database 140 with information related to the network device 114, as shown at 402. In another example, the database update 402 may occur during the onboarding process.

[0072] The onboarding of the network device 114 occurs when the network device 114 issues a DHCP broadcast query, which is received by the DHCP server 104, as shown at 404. The DHCP server 104 provides a DHCP offer with connection information for the local activation server agent 130 in response to the DHCP broadcast query, as shown at 408. In response to the DHCP offer, the network device 114 may then contact the local activation server agent 412, as shown at 412, to receive connection information for the local central server agent, as shown at 416.

[0073] In response to contact from the network device 114, the local activation server 114 can verify the network device, as shown in 414. In one example, verification can involve the local activation server agent 118 determining whether the network device 114 has registered a corresponding subscription. In another example, verification can include the local activation server agent 118 determining whether the network device 114 has a valid digital certificate or whether it possesses one or more other credentials. In another example, verification performed by the local activation server agent 118 can include the local activation server agent 118 determining whether the network device 114 is compatible with the local branch network or corresponds to a device type associated with the minimum standards of the local branch network. In response to the local activation server agent 118 successfully verifying the network device 114, the local activation server agent 118 can then provide the network device 114 with connection information of the local central server agent 130, as shown in 416.

[0074] In response to receiving the connection information of the local central server agent 130, the network device 114 can then provide a load request to the local central server agent 130, as shown at 420. In addition, the network device 114, the local central server agent 130, and the central application 192 can establish a load data synchronization, as shown at 424 and 430. In the event that data synchronization is established, the central application 192 can then provide the configuration data to the local central agent 130. The local central server agent 130 can then read the configuration data from the appropriate receive queue, as shown at 442, and provide the configuration data to the network device 114, as shown at 446.

[0075] In one example, the configuration data may correspond to one or more configuration files (e.g., Yet Another Markup Language (YAML) files). In one example, the configuration data may configure any of a plurality of different settings of the network device 114, such as quality of service (QoS) settings, class of service (CoS) settings, virtual local area network (VLAN) tag settings, VLAN untag settings, ingress bandwidth settings, egress bandwidth settings, Power over Ethernet (POE) settings, and various and / or other configurable settings of the network device 114. In another example, the configuration data may include a firmware image of the network device 114.

[0076] As shown at 450, the network device 114 may provide the configuration data synchronization confirmation by writing the configuration data synchronization confirmation information to the appropriate transmission queue, as shown at 450 and 454. Accordingly, the local central server agent 130 may then provide the configuration data synchronization confirmation to the central application 192, as shown at 458.

[0077] Figure 5Depicted is a sequence flow chart 500 showing communication between a local central server agent 130 and a remote central server 188 for monitoring network devices and overseeing implementation of remediation solutions to remedy problems associated with network devices. In one example, for these purposes, the remote central server 188 may include a monitoring application and a central application, as described herein.

[0078] refer to Figure 5 , the network device 114 may provide a network telemetry message 504 that is received by the local central server agent 130, as shown at 504. Data corresponding to the network telemetry message is written to a corresponding transmission queue of the local central server agent 130, as shown at 508, and the local central server agent 130 merges the messages from the transmission queue, as shown at 512.

[0079] The local central server agent 130 may then send one or more merged network telemetry messages to the remote central server 188, as shown at 516. The remote central server 188 may then classify the telemetry messages from the merged message(s) according to the network device, and the remote central server 188 may then analyze the network telemetry data, as shown at 520. In addition, for any identified issues that can be resolved by the remote central server 188, as shown at 524, the remote central server 188 may generate data in response to the analysis and send corresponding messages to the local central server agent, as shown at 524 and 528.

[0080] The local central server agent 130 may then sort the merged telemetry analysis response message into the appropriate receive queues, as shown at 532. The local central server agent 130 may then send the telemetry analysis message from these receive queues to the appropriate network devices 114, as shown at 536.

[0081] The local central server agent can preemptively retrieve the newer version firmware image for its managed network device collection, which allows the newer version firmware image to be locally available when the corresponding firmware upgrade of the network device is initiated. More specifically, Figure 6 A sequence flow diagram 600 is depicted that illustrates communications associated with performing a firmware upgrade on a network device 114 according to an example implementation.

[0082] refer to Figure 6 , the local central server agent 130 can communicate with the remote central server 188 to preemptively retrieve the firmware image from the remote central server 188, as shown in 604. The local central server agent 130 can store the retrieved firmware image in the local firmware library 142, as shown in 608.

[0083] Figure 6Depicted is a firmware upgrade request 612 submitted from a management node 198 for the purpose of performing a firmware upgrade for a particular network device 114. Again, for this example, the firmware upgrade corresponds to a firmware image that has been previously retrieved by a local central server agent 130 and stored in a local firmware repository 142. For example, the firmware upgrade request 612 may be provided by an administrator selecting a firmware upgrade option and selecting a particular network device 114 from a dashboard (e.g., a dashboard provided by a central server).

[0084] When performing a firmware upgrade, the local central server agent 130 may read the appropriate firmware image from the firmware library 142 and verify the firmware image, as shown at 614 and 616. In response to the firmware image being verified, the local central server agent 130 may then communicate with the network device 114 to provide the firmware image to the network device 114 and manage the firmware upgrade, as shown at 620.

[0085] refer to Figure 7 According to an example implementation, process 700 includes establishing (block 704) by a local activation server agent of a first local branch computer network a first connection with an activation server of a central computer system. In one example, the central activation server may be a cloud-based server. The activation server manages network device authentication information corresponding to a plurality of local branch computer networks including the first local branch computer network. In one example, the activation server may be a cloud-based server. In an example, the local branch computer network may be an edge network, a campus network, an IoT network, or a data center network.

[0086] According to block 708, process 700 includes communicating, by a local activation server agent, with an activation server via a first connection to receive network device authentication information for a given network device associated with an entity associated with a first local branch computer network. In one example, the given network device may be a network switch. In one example, the communication may occur prior to the first connection of the given network device to the first local branch computer network. In one example, the network device authentication information may include an identifier corresponding to the given network device. In one example, the network device authentication information may associate the identifier with a subscription. In one example, the local activation server agent may be a local activation server agent in an HA group of local activation server agents.

[0087] According to block 712, the process includes establishing a second connection between the given network device and the local activation server agent in response to the given network device being connected to the first local branch computer network. In one example, the second connection may be established in response to the given network device receiving connection details of the local activation server agent from the DCHP server and providing the connection details to the local activation server agent. According to an example implementation, the connection details may be provided as one or more DCHP options. In one example, the connection details may include an IP address of the local activation server agent.

[0088] According to box 716, process 700 includes verifying, by a local activation server agent, a given network device based on network device verification information for the given network device. In one example, in response to the local activation server agent determining that an identifier of the given network device has been registered to a specific subscription, the local activation server agent may verify the given network device. In one example, in response to the local activation server agent determining that the network device has a device type compatible with the first local branch computer network, the local activation server agent may verify the given network device. Verification includes the local activation server agent communicating with the given network device via a second connection. In one example, the local activation server agent may provide the given network device with connection details of a local central server agent in response to verifying the given network device. In one example, the local central server agent may correspond to a central server of a central computer system. In one example, the central server may be a cloud-based server. In one example, the connection details may include an IP address of the central server agent. In one example, the connection details may include a digital credential.

[0089] refer to Figure 8According to an example implementation, the system 800 includes a plurality of network devices 810 and a first branch computer network 814. The first branch computer network 814 includes a local activation server agent. The local activation server agent provides a customer credential associated with the first branch computer network to a cloud-based activation server to establish a first connection between the local activation server agent and the activation server. The activation server is associated with a plurality of branch computer networks including the first branch computer network. In one example, the branch computer network may include at least one of a campus network, a data center network, an edge network, or an IoT network. In one example, the customer credential may be an identifier associating the first branch computer network with a subscription. In one example, the local activation server agent may be a local activation server agent in a HA group of a plurality of local activation server agents. In one example, the local activation server agent may be hosted by one or more nodes of the first branch computer network. In one example, the nodes may be physical nodes and / or virtual nodes. In one example, the nodes may be associated with one or more physical processors and memories.

[0090] The local activation server agent 820 retrieves network device authentication information from the activation server via the first connection. The local activation server agent 820 communicates with the first network device in response to the first network device being connected to the first branch computer network to authenticate the first network device based on the network device authentication information. In one example, the local activation server agent establishes the first connection and retrieves the network device authentication information before the connection of the first network to the first branch computer network. In one example, the first network device can be a second level (L2) or third level (L3) switch. In other examples, the network device can be a gateway, a multicast router, a bridge, a component of a Generation Z or Compute Express Link (CXL) network, a processor device, a network interface controller (NIC), or a fabric switch including one or more of the above devices.

[0091] refer to Fig. 9 According to an example implementation, the non-transitory storage medium 900 stores machine-readable instructions 910. The machine-readable instructions 910 correspond to a local activation server agent of a first local network. In one example, the local activation server agent may be a local activation server agent in an HA group of multiple local activation server agents. In one example, the local activation server agent may be hosted by one or more nodes of a first branch computer network. In one example, the nodes may be physical nodes and / or virtual nodes. In one example, the nodes may be associated with one or more physical processors and memories. In one example, the first local network may be a branch network. In some examples, the first local network may be a campus network, a data center network, an edge network, or an IoT network.

[0092] The machine-readable instructions 910, when executed by a machine in a first local network, cause the machine to provide a credential associated with a subscription identity to a cloud-based activation server to establish a first connection between a local activation server agent and a central activation server. In one example, the credential may associate a local activation server agent with a subscription account. The activation server manages network device authentication information for a plurality of local computer networks including the first local branch computer network.

[0093] The machine-readable instructions 910, when executed by the machine, also cause the machine to retrieve network device authentication information corresponding to a plurality of network devices via a first connection, the plurality of network devices being associated with a subscription identity. In an example, the network device may include an L2 and / or L3 switch. In other examples, the network device may include one or more of the following: a gateway, a multicast router, a bridge, a component of a Generation Z or Compute Express Link (CXL) network, a processor device, a network interface controller (NIC), or a fabric switch including one or more of the above devices.

[0094] The machine-readable instructions 910, when executed by the machine, also cause the machine to communicate with the first network device in response to the first network device of the plurality of network devices being connected to the first local branch computer network to verify the first network device based on a subset of network device verification information corresponding to the first network device. In one example, the network device verification information may associate an identifier of the first network device with a network management service subscription. In one example, the instructions 910 may cause the machine to verify the network device based on one or more other criteria. In one example, the verification criterion may be a device type of the first network device. In one example, the verification criterion may be a firmware version associated with the first network device. In another example, the verification criterion may indicate compatibility of the first network device with the first local branch computer network.

[0095] According to an example implementation, verifying a given network device includes receiving, by a local activation server agent, a device identifier of the given network device, and verifying, by the local activation server agent, that the device has an associated license. Among the advantages, the availability of a local activation server agent helps to troubleshoot any potential problems with a local network.

[0096] According to an example implementation, verifying the network device includes receiving, by the local activation server agent, a device type of a given network device, and verifying, by the local activation server agent, that the device type is compatible with the first local branch computer network. Among the advantages, the availability of the local activation server agent helps to troubleshoot any potential problems with the local network.

[0097] According to an example implementation, establishing the second connection includes sending at least one of the address of a local activation server agent or the credentials of the second connection to a given network device by a dynamic host control protocol (DHCP) server. Among these advantages, the availability of a local activation server agent helps to eliminate any potential problems of a local network.

[0098] According to an example implementation, a local server activation agent can detect a communication from a local central server agent of a first local branch computer network. In response to detecting the communication, the local server activation agent sends information to the local central server agent to allow the local central server agent to connect to a central server of a central computer system. The central server manages network devices of multiple local branch computer networks. The local central server agent communicates with the central server to establish a third connection between the local central server agent and the central server. Among the advantages, the use of local agents (such as local server activation agents and local central server agents) can enhance troubleshooting capabilities. In addition, the local central server agent reduces the number of network connections to the central server.

[0099] According to an example implementation, a local central server agent maintains an inventory of network devices of a first local branch computer network. In response to successful authentication of a given network device by a local activation server agent, the local central server agent adds the given network device to the inventory. Among the advantages, the use of local agents (such as a local server activation agent and a local central server agent) can enhance troubleshooting capabilities. In addition, the local central server agent reduces the number of network connections to the central server.

[0100] According to an example implementation, a central server agent receives a first message from a corresponding network device of a first local branch computer network, and merges the first message to provide first merged data. The local central manager agent sends the first merged data to the central server via a third connection, and receives second merged data from the central server via the third connection. The second merged data is separated into a second message, and the local central server agent sends the second message to the corresponding network device of the first local branch computer network. Among the advantages, the use of local agents (such as a local server activation agent and a local central server agent) enhances troubleshooting. In addition, the local central server agent reduces the number of network connections to the central server.

[0101] According to an example implementation, a local central server agent predictably retrieves a firmware image for a network device of a first local branch computer network and stores the firmware image in a repository. A firmware upgrade can then be performed on the network device, including the retrieval of the firmware image from the repository by the local central server agent. Among the advantages, firmware upgrades of the network device can be accelerated.

[0102] The detailed description described herein refers to the accompanying drawings. Where possible, the same reference numerals are used in the drawings and the foregoing description to refer to the same or similar parts. However, it should be clearly understood that the drawings are only for illustration and description. Although several examples are described in this document, modifications, adaptations and other implementations are also possible. Therefore, the detailed description does not limit the disclosed examples. On the contrary, the proper scope of the disclosed examples can be defined by the appended claims.

[0103] The terms used in this article are only used to describe specific examples, not limiting terms. As used in this article, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" should also include plural forms. The term "multiple" used in this article is defined as two or more. The term "another" used in this article is defined as at least the second or more. Unless otherwise specified, the term "connected" used in this article is defined as connected, whether it is directly connected without any intervening element, or indirectly connected with at least one intervening element. Two elements can be connected mechanically, electrically or communicatively through a communication channel, path, network or system. The term "and / or" used in this article refers to and covers any and all possible combinations of related listed items. It should also be understood that although the terms first, second, third, etc. can be used to describe various elements in this article, these elements should not be limited by these terms, because unless otherwise specified or the context indicates otherwise, these terms are only used to distinguish one element from another element. As used in this article, the term "includes" means including but not limited to, and the term "including" means including but not limited to. The term "based on" means at least partially based on.

[0104] While the present disclosure has been described with respect to a limited number of implementations, those skilled in the art having the benefit of this disclosure will appreciate numerous modifications and variations thereof. The appended claims are intended to cover all such modifications and variations.

Claims

1. A method comprising: establishing, by a local activation server agent of a first local branch computer network among a plurality of local branch computer networks, a first connection to an activation server of a central computer system, wherein the activation server manages network device authentication information corresponding to the plurality of local branch computer networks; communicating, by the local activation server agent, with the activation server over the first connection to receive network device authentication information for a given network device associated with an entity associated with the first local branch computer network; establishing a second connection between the given network device and the local activation server agent in response to the given network device being connected to the first local branch computer network; as well as The given network device is authenticated by the local activation server agent based on the network device authentication information for the given network device, wherein the authentication includes the local activation server agent communicating with the given network device through the second connection.

2. The method of claim 1 , wherein authenticating the given network device comprises: A device identifier of the given network device is received by the local activation server agent, and the device identifier is verified by the local activation server agent to have an associated license.

3. The method of claim 1 , wherein authenticating the network device comprises: A device type for the given network device is received by the local activation server agent, and the device type is verified by the local activation server agent to be compatible with the first local branch computer network.

4. The method of claim 1, wherein establishing the second connection comprises at least one of: sending, by a Dynamic Host Control Protocol (DHCP) server, an address of the local activation server agent to the given network device, or credentials for the second connection.

5. The method according to claim 1, further comprising: detecting, by said local server activation agent, communications from a local central server agent of said first local branch computer network; In response to detecting the communication, sending, by the local server activation agent, information to the local central server agent to allow the local central server agent to connect to a central manager, wherein the central manager manages network devices of the plurality of local branch computer networks; as well as The local central server agent communicates with the central manager to establish a third connection between the local central server agent and the central manager.

6. The method according to claim 5, further comprising: maintaining, by the local central server agent, an inventory of network devices of the first local branch computer network; as well as In response to successful authentication of the given network device by the local activation server agent, the given network device is added to the inventory by the local central server agent.

7. The method according to claim 5, further comprising: receiving, by the local central server agent, a first message from a corresponding network device of the first local branch computer network; merging, by the local central server agent, the first messages to provide first merged data; sending, by the local central server agent, the first merged data to the central manager via the third connection; receiving, by the local central server agent via the third connection, second merged data from the central manager; separating the second combined data into second messages; as well as The second message is sent by the local central server agent to a corresponding network device of the first local branch computer network.

8. The method according to claim 5, further comprising: predictively retrieving, by the local central server agent, a firmware image for a network device of the first local branch computer network; storing, by the local central server agent, the firmware image in a repository; as well as Performing a firmware upgrade of the plurality of network devices includes retrieving, by the local central server agent, the firmware image from the repository.

9. A system comprising: A plurality of network devices, including a first network device; as well as A local activation server agent of the first branch computer network, the local activation agent is used to: providing a customer credential associated with the first branch computer network to a cloud-based remote activation server to establish a first connection between the local activation server agent and the remote activation server, wherein the remote activation server is associated with a plurality of branch computer networks including the first branch computer network; retrieving network device authentication information from the remote activation server via the first connection; as well as In response to the first network device being connected to the first branch computer network, communicating with the first network device to authenticate the first network device based on the network device authentication information.

10. The system according to claim 9, further comprising: The local central server agent of the first branch computer network, the local central server agent is used to: receiving connection information from the local activation server agent to allow the local central server agent to establish a second connection with a remote cloud-based central server; receiving data from the plurality of network devices; as well as The data received from the plurality of network devices is transmitted to the remote central server via the second connection.

11. The system of claim 10, wherein: The remote central server is used to process the data transmitted to the remote central server by the local central server agent; and The local central server agent is used to communicate with the remote central server via the second connection to receive data representing the results of the processing.

12. The system of claim 10, wherein the data transmitted by the local central server agent to the remote central server comprises at least one of: data representing statistics associated with the plurality of network devices, or data representing network telemetry metrics.

13. The system of claim 10, wherein the local central server agent is to communicate with the remote central server via the second connection to receive data representing configuration data for the plurality of network devices.

14. The system of claim 10, wherein the local central server agent is to transmit data representing a last known good configuration for the first network device to the first network device in response to detecting a failure of the first network device.

15. The system of claim 10, wherein the local central server agent is further configured to: maintaining an inventory of the plurality of network devices; and In response to the local activation server agent successfully authenticating the first network device, the first network device is added to the plurality of network devices.

16. The system of claim 10, further comprising: A Dynamic Host Control Protocol (DHCP) server is configured to provide the first network device with an address of the local activation server agent and credentials for forming a connection with the local activation server agent in response to the first network device being connected to the local computer network.

17. A non-transitory storage medium storing machine-readable instructions that correspond to a local activation server agent of a first local network and that, when executed by a machine of the first local network, cause the machine to: providing credentials associated with the subscription identification to a cloud-based activation server to establish a first connection between the local activation server agent and the activation server, wherein the activation server manages network device authentication information for a plurality of local computer networks including the first local branch computer network; retrieving, via the first connection, network device authentication information corresponding to a plurality of network devices associated with the subscription identifier; and In response to a first network device of the plurality of network devices being connected to the first local branch computer network, communicating with the first network device to authenticate the first network device based on a subset of the network device authentication information corresponding to the first network device.

18. The storage medium of claim 17, wherein the instructions, when executed by the machine, further cause the machine to retrieve the network authentication information before any network device among the plurality of network devices initially connects to the first local branch computer network.

19. The storage medium of claim 17, wherein the instructions, when executed by the machine, further cause the machine to: monitoring a port for communications from a local central server agent of the first local branch computer network, wherein the local central server agent is associated with a cloud-based central server and the central server performs network device analysis processing for the plurality of local computer networks; responsive to detecting the communication, authenticating the local central server agent; as well as In response to authenticating the local central server agent, connection information is provided to the local central server agent to allow the local central server agent to form a connection with the central server.

20. The storage medium of claim 19, wherein the instructions, when executed by the machine, further cause the machine to: provide connection information to the first network device in response to the authentication of the first network device to allow the first network device to form a connection with the local central server agent.

Images