Method for generating strategy configuration of new site based on custom template

Abstract

The application relates to the technical field of grid connection scheme generation, in particular to a new site grid connection scheme generation strategy configuration method based on a self-defined template, which comprises the following steps: defining a template of a grid connection scheme according to the office network and the data center type of a site through a graphical interface; inputting the name, equipment IP range and resources needing to be accessed of the site; and pre-allocating IP addresses for site equipment according to IP allocation rules defined in the template and performing conflict detection. The application pre-defines the template of the grid connection scheme, only needs to configure two key information of the IP range and the specified access resources, can automatically generate subsequent contents such as the security policy and the execution script, and can timely discover and correct possible mismatching problems by automatically checking the generated strategy and the scheme, so that the configuration efficiency is effectively improved and the strategy consistency is ensured compared with the traditional technology in the background art.

Description

Technical Field

[0001] The present invention relates to the technical field of grid connection scheme generation, and in particular to a method for configuring a new site grid connection scheme generation strategy based on a custom template. Background Art

[0002] Configuring network security strategies often requires setting up multiple aspects separately. You need to manually determine the IP range first, then set up accessible resources one by one according to different business needs, and then write security strategies and execute scripts separately. This is a complex and time-consuming process involving multiple different operation links and systems.

[0003] In existing technologies, network administrators first add network security devices such as switches and firewalls to the station side, and then define access policies on the network devices to determine which IP addresses or network segments can access specific destination resources, and which network services (such as HTTP, FTP, etc.) are allowed or prohibited. This is relatively basic and manual, lacking the flexibility and automation of custom text templates. Administrators need to have an in-depth understanding of the command line operations of network devices. In addition, when faced with complex network requirements, the configuration process may become cumbersome and prone to errors.

[0004] Based on this, the present invention provides a method for configuring a new site grid connection solution generation strategy based on a custom template to solve the above-mentioned technical problems. Summary of the Invention

[0005] The purpose of the present invention is to provide a method for configuring a new site grid connection plan generation strategy based on a custom template, so as to solve the problems raised by the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A method for configuring a new site grid connection plan generation strategy based on a custom template is provided, which includes the following steps:

[0008] S1. Use the graphical interface to customize the grid connection solution template based on the site's office network and data center type.

[0009] S2. Enter the site name, device IP range, and resources to be accessed.

[0010] S3. Pre-allocate IP addresses for site devices and perform conflict detection according to the IP allocation rules defined in the template;

[0011] S4. Generate security policy rules based on the pre-assigned IP addresses and the resources required for the site, and display them in the format specified in the template.

[0012] S5. Adapt and generate an executable policy script based on the device type and the policy to be activated;

[0013] S6. Use an object comparison algorithm to verify the completeness of the generated strategy and perform necessary optimizations;

[0014] S7. Send the generated policy script to the designated network device and verify that it has been successfully sent.

[0015] S8. Recover basic information and configuration data of mining equipment, archive and update;

[0016] S9. Provide a visual interface to display information such as the configured network topology, policy distribution, and device status, and collect user feedback on the configuration effect.

[0017] Preferably, the implementation steps of step S1 are:

[0018] S1.1. The user selects a template from the pre-set template library that matches the site's office network or data center type, including enterprise branches and data centers.

[0019] S1.2. Set the starting and ending range of the IP address segment, as well as the subnet mask, define static IP allocation rules or dynamic DHCP allocation policies, and specify the IP allocation priority for server or switch device types;

[0020] S1.3. Define the basic framework of the security policy, including access control lists (ACLs), firewall rules, and set policy priorities and conflict resolution mechanisms;

[0021] S1.4. Determine which devices require remote access permissions, as well as SSH and HTTPS access methods, and format the policy file, including XML and JSON, to facilitate subsequent automated processing.

[0022] S1.5. List the types of routers, firewalls, and cameras that may be involved, and design a template for the device inventory, including fields for device name, model, serial number, and IP address.

[0023] S1.6. Check the completeness of the template settings to ensure that no items are missing, apply the template settings, and generate the initialized configuration file and policy framework.

[0024] Preferably, the implementation steps of step S2 are:

[0025] S2.1. Enter the site's name, location, and network type into the system.

[0026] S2.2. Based on the site size and network plan, enter the starting and ending range of device IP addresses, and confirm that the IP range does not conflict with the existing network.

[0027] S2.3. Select the external or internal resources that the site needs to access from the resource list, including databases and servers, and specify the read-only or read-write permission level for accessing the resources.

[0028] S2.4. The system automatically saves the entered data and performs data verification to ensure the accuracy and completeness of the information.

[0029] Preferably, the implementation steps of step S3 are:

[0030] S3.1. Load IP allocation rules from the template;

[0031] S3.2. Assign an IP address to each device based on device type and priority, record the assignment results, and generate an IP address assignment table;

[0032] S3.3. Compare the pre-assigned IP address with the IP address in the existing network to check for conflicts. If there are conflicts, the IP allocation will be automatically adjusted or the user will be prompted to manually adjust it.

[0033] S3.4. Summarize the conflict detection results, including conflicting devices, IP addresses, and suggested solutions, and provide them to the user for reference so that necessary adjustments can be made.

[0034] Preferably, the implementation steps of step S4 are:

[0035] S4.1. Obtain the device's pre-assigned IP and site resource requirements from the previous step;

[0036] S4.2. Generate security policy rules for each device based on resource access requirements. These rules include the resources allowed / denied, time ranges, and protocol types.

[0037] S4.3. Convert the policy rules into a readable text or configuration file format according to the format defined in the template;

[0038] S4.4. Display the generated policy rules in a graphical interface for users to review and confirm, and provide editing functions to allow users to make fine adjustments as needed.

[0039] Preferably, the implementation steps of step S5 are:

[0040] S5.1. Read the device inventory and identify the type of each device (including Cisco routers and Huawei firewalls).

[0041] S5.2. Select the appropriate policy script template from the script library based on the device type;

[0042] S5.3. Fill the previously generated security policy rules into the script template and adjust the parameters and commands in the script according to the device characteristics;

[0043] S5.4. Compile the script to generate a policy configuration script that can be executed on the target device and perform a syntax check to ensure the script is correct.

[0044] S5.5. Save the generated script file to a specified location for subsequent distribution and use.

[0045] Preferably, the implementation steps of step S6 are:

[0046] S6.1. Read the generated strategy file and load it into the comparison algorithm;

[0047] S6.2. Compare the IP addresses, port numbers, and service type objects in the policy file with the expected configuration to check for omissions or incorrect configurations.

[0048] S6.3. Summarize the comparison results and generate a detailed comparison report that identifies any inconsistencies and provides optimization suggestions.

[0049] S6.4. Make necessary adjustments and optimizations to the strategy based on the comparison report to ensure its consistency and accuracy.

[0050] Preferably, the implementation steps of step S7 are:

[0051] S7.1. Select the SSH, Telnet, or SNMP delivery channel and configure the connection parameters.

[0052] S7.2. Send the policy script to the target device via the selected delivery channel and monitor the delivery process to ensure successful script transmission.

[0053] S7.3. Log in to the target device and check whether the policy has been successfully loaded and is effective. Use commands or tools to verify the correctness of the policy configuration.

[0054] S7.4. Summarize the distribution results and generate a distribution report, which includes the distribution time, device name, distribution status and possible error information.

[0055] Preferably, the implementation steps of step S8 are:

[0056] S8.1. Set up a mining task in the system, specifying the equipment to be mined, the data items, and the mining period;

[0057] S8.2. Retrieve basic information and configuration data from the device via the network or API, including device status, IP address, and configuration parameters.

[0058] S8.3. Archive the collected data into a database or file system and organize the data to ensure its accuracy and readability.

[0059] S8.4. Update the relevant information in the equipment ledger based on the recovered data to ensure that the equipment ledger is consistent with the actual situation.

[0060] Preferably, the implementation steps of step S9 are:

[0061] S9.1. Use graphical tools to design intuitive network topology diagrams, policy distribution maps, and device status dashboards.

[0062] S9.2. Dynamically display the configured network topology on the interface, including device connection relationships and IP address allocation;

[0063] S9.3. Display the distribution of security policies in a chart or table format, including which devices have which policies applied.

[0064] S9.4. Real-time update of device status information, including online / offline, CPU usage, and memory usage;

[0065] S9.5. Provide a feedback portal to allow users to submit opinions and suggestions on configuration effects, and regularly organize user feedback to improve system functions and performance.

[0066] Compared with the prior art, the present invention has the following beneficial effects:

[0067] The present invention predefines a template for the grid connection plan. It only needs to configure two key information, the IP range and the specified access resources, to automatically generate security strategies, execute scripts and other subsequent content. At the same time, by automatically verifying the generated strategies and plans, it can timely discover and correct possible mismatch problems. In summary, compared with the traditional technology in the background technology, the present invention can effectively improve configuration efficiency and ensure policy consistency. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a flow chart of the method for generating a strategy configuration method for a new site grid connection solution based on a custom template according to the present invention. DETAILED DESCRIPTION

[0069] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0070] Example:

[0071] See also Figure 1 The present invention proposes a method for configuring a new site grid connection plan generation strategy based on a custom template, specifically comprising the following steps:

[0072] S1. Use the graphical interface to customize the grid connection solution template based on the site's office network and data center type.

[0073] Specifically, the implementation steps of step S1 are:

[0074] S1.1. The user selects a template from the pre-set template library that matches the site's office network or data center type, including enterprise branches and data centers.

[0075] S1.2. Set the starting and ending range of the IP address segment, as well as the subnet mask, define static IP allocation rules or dynamic DHCP allocation policies, and specify the IP allocation priority for server or switch device types;

[0076] S1.3. Define the basic framework of the security policy, including access control lists (ACLs), firewall rules, and set policy priorities and conflict resolution mechanisms;

[0077] S1.4. Determine which devices require remote access permissions, as well as SSH and HTTPS access methods, and format the policy file, including XML and JSON, to facilitate subsequent automated processing.

[0078] S1.5. List the types of routers, firewalls, and cameras that may be involved, and design a template for the device inventory, including fields for device name, model, serial number, and IP address.

[0079] S1.6. Check the completeness of the template settings to ensure that no items are missing, apply the template settings, and generate the initial configuration file and policy framework.

[0080] This step defines basic information such as the site device's IP allocation rules, policy generation rules, security device access and policy format, device type, and device ledger format. At the same time, the template is initialized to ensure the smooth progress of subsequent steps.

[0081] S2. Enter the site name, device IP range, and resources to be enabled.

[0082] Specifically, the implementation steps of step S2 are:

[0083] S2.1. Enter the site's name, location, and network type into the system.

[0084] S2.2. According to the site size and network planning, input the start and end range of the device IP address, confirm that the IP range does not conflict with the existing network;

[0085] S2.3. From the resource list, check the external or internal resources that the site needs to access, including databases, servers, and specify the read-only and read-write permission levels for accessing resources;

[0086] S2.4. The system automatically saves the entered data, performs data verification, and ensures the accuracy and completeness of the information;

[0087] Through this step, basic data support is provided for subsequent configuration;

[0088] S3. According to the IP allocation rules defined in the template, pre-allocate IP addresses for site devices and perform conflict detection;

[0089] Specifically, the implementation steps of step S3 are:

[0090] S3.1. Load the IP allocation rules from the template;

[0091] S3.2. According to the device type and priority, allocate IP addresses for each device, record the allocation results, and generate an IP address allocation table;

[0092] S3.3. Compare the pre-allocated IP addresses with the IP addresses in the existing network to check for conflicts. If there is a conflict, automatically adjust the IP allocation or prompt the user to manually adjust;

[0093] S3.4. Summarize the conflict detection results, including the conflicting devices, IP addresses, and suggested solutions, and provide them to the user for reference to make necessary adjustments;

[0094] Through this step, it is ensured that the allocated IP addresses do not conflict, improving the accuracy and efficiency of the configuration;

[0095] S4. According to the pre-allocated IP addresses and the resources that the site needs to open, generate security policy rules and display them according to the format in the template;

[0096] Specifically, the implementation steps of step S4 are:

[0097] S4.1. Obtain the pre-allocated IP of the device and the site resource demand from the previous step;

[0098] S4.2. According to the resource access demand, generate corresponding security policy rules for each device, including allowed / rejected access resources, time range, and protocol type;

[0099] S4.3. Convert the policy rules into readable text or configuration file format according to the format defined in the template;

[0100] S4.4. In the graphical interface, the generated policy rules are displayed for the user to view and confirm, and editing functions are provided to allow the user to fine-tune as needed;

[0101] Through this step, the policy rules are generated, manual operations are reduced, and configuration efficiency is improved;

[0102] S5. According to the device type and the policy to be opened, an executable policy script is adapted and generated;

[0103] Specifically, the implementation steps of step S5 are:

[0104] S5.1. Read the device account to identify the type of each device (including Cisco router, Huawei firewall);

[0105] S5.2. According to the device type, select the corresponding policy script template from the script library;

[0106] S5.3. Fill the previously generated security policy rules into the script template, and adjust the parameters and commands in the script according to the device characteristics;

[0107] S5.4. Compile the script to generate a policy configuration script that can be executed on the target device, perform syntax checking to ensure that the script is error-free;

[0108] S5.5. Save the generated script file to a designated location for subsequent use;

[0109] Through this step, it is ensured that the policy script matches the device type, improving the compatibility and execution efficiency of the script;

[0110] S6. Use an object comparison algorithm to check whether the generated policy is complete and make necessary optimizations;

[0111] Specifically, the implementation steps of step S6 are:

[0112] S6.1. Read the generated policy file and load it into the comparison algorithm;

[0113] S6.2. Compare the IP addresses, port numbers, and service type objects in the policy file with the expected configuration to check for any missing or incorrect configurations;

[0114] S6.3. Summarize the comparison results to generate a detailed comparison report indicating inconsistencies and providing optimization suggestions;

[0115] S6.4. According to the comparison report, make necessary adjustments and optimizations to the policy to ensure its consistency and accuracy;

[0116] Through this step, the consistency and accuracy of the policy are ensured, and possible problems are discovered and corrected in a timely manner;

[0117] S7. The generated policy script is issued to the specified network device, and verification of successful issuance is performed;

[0118] Specifically, the implementation steps of step S7 are:

[0119] S7.1. Select an SSH, Telnet or SNMP issuance channel and configure connection parameters;

[0120] S7.2. Send the policy script to the target device through the selected issuance channel, monitor the issuance process, and ensure successful transmission of the script;

[0121] S7.3. Log in to the target device, check whether the policy has been successfully loaded and taken effect, and verify the correctness of the policy configuration using commands or tools;

[0122] S7.4. Summarize the issuance results, generate an issuance report, and include issuance time, device name, issuance status and possible error information in the report;

[0123] Through this step, it is ensured that the policy script can be correctly issued to the device, improving the reliability of the configuration;

[0124] S8. Extract the basic information and configuration data of the device and perform archiving and updating;

[0125] Specifically, the implementation steps of step S8 are:

[0126] S8.1. Set the extraction task in the system, specify the devices, data items and extraction period that need to be extracted;

[0127] S8.2. Extract the basic information and configuration data from the device through the network or API interface, including device status, IP address, configuration parameters;

[0128] S8.3. Archive the extracted data in the database or file system, organize the data, and ensure the accuracy and readability of the data;

[0129] S8.4. Update the related information in the device account according to the extracted data, and ensure that the device account is consistent with the actual situation;

[0130] Through this step, the management of the device account is realized, and the timely and accurate recording of device information is ensured;

[0131] S9. Provide a visual interface to display the network topology after configuration, policy distribution and device status information, and collect user feedback on the configuration effect;

[0132] Specifically, the implementation steps of step S9 are:

[0133] S9.1. Use graphical tools to design intuitive network topology diagrams, policy distribution maps, and device status dashboards.

[0134] S9.2. Dynamically display the configured network topology on the interface, including device connection relationships and IP address allocation;

[0135] S9.3. Display the distribution of security policies in a chart or table format, including which devices have which policies applied.

[0136] S9.4. Real-time update of device status information, including online / offline, CPU usage, and memory usage;

[0137] S9.5. Provide a feedback portal to allow users to submit comments and suggestions on configuration effects. Regularly organize user feedback to improve system functionality and performance.

[0138] This step allows network administrators to intuitively understand the configuration effects, identify and resolve problems in a timely manner, and continuously optimize functions and performance based on user feedback.

[0139] In summary, through steps S1 to S9, the present invention predefines the template of the grid connection plan, and only needs to configure two key information, namely, the IP range and the specified access resources, to automatically generate security strategies, execute scripts and other subsequent content. At the same time, by automatically verifying the generated strategies and plans, possible mismatch problems can be discovered and corrected in a timely manner.

[0140] In summary, the present invention can effectively improve configuration efficiency and ensure policy consistency compared to the traditional technology in the background art.

[0141] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0142] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the content of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for configuring a new site grid connection plan generation strategy based on a custom template, characterized in that: The following steps are involved: S1. Use the graphical interface to customize the grid connection solution template based on the site's office network and data center type. S1.

1. The user selects a template from the pre-set template library that matches the site's office network or data center type as a basis. S1.

2. Set the starting and ending range of the IP address segment and the subnet mask, define static IP allocation rules or dynamic DHCP allocation policies, and specify the IP allocation priority for server or switch device types; S1.

3. Define the basic framework of security policies, set policy priorities and conflict resolution mechanisms; S1.

4. Determine which devices require remote access permissions and format the policy file; S1.

5. List the types of routers, firewalls, and cameras that may be involved, and design a template for the device inventory; S1.

6. After checking the integrity of the template settings, apply the template settings and generate the initial configuration file and policy framework; S2. Enter the site name, device IP range, and resources to be accessed. S3. Pre-allocate IP addresses for site devices and perform conflict detection according to the IP allocation rules defined in the template; S4. Generate security policy rules based on the pre-assigned IP addresses and the resources required for the site, and display them in the format specified in the template. S5. Adapt and generate an executable policy script based on the device type and the policy to be activated; S6. Use an object comparison algorithm to verify the completeness of the generated strategy and perform necessary optimizations; S7. Send the generated policy script to the specified network device and verify the success of the delivery; S8. Retrieve basic information and configuration data of mining equipment and archive and update it; S9. Provide a visual interface to display the configured network topology, policy distribution, and device status, and collect user feedback on the configuration effect.

2. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 1, characterized in that: The implementation steps of step S2 are: S2.

1. Enter the site's name, location, and network type into the system. S2.

2. Based on the site size and network plan, enter the starting and ending range of device IP addresses, and confirm that the IP range does not conflict with the existing network. S2.

3. Select the external or internal resources that the site needs to access from the resource list and specify the read-only or read-write permission level for the resources. S2.

4. The system automatically saves the entered data and performs data verification.

3. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 2, characterized in that: The implementation steps of step S3 are: S3.

1. Load IP allocation rules from the template; S3.

2. Assign an IP address to each device based on device type and priority, record the assignment results, and generate an IP address assignment table; S3.

3. Compare the pre-assigned IP address with the IP address in the existing network to check for conflicts. If there are conflicts, the IP allocation will be automatically adjusted or the user will be prompted to manually adjust it. S3.

4. Summarize the conflict detection results, including conflicting devices, IP addresses, and suggested solutions, and provide them to users for reference.

4. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 3, characterized in that: The implementation steps of step S4 are: S4.

1. Obtain the device's pre-assigned IP and site resource requirements from the previous step; S4.

2. Generate corresponding security policy rules for each device based on resource access requirements; S4.

3. Convert the policy rules into a readable text or configuration file format according to the format defined in the template; S4.

4. Display the generated policy rules in a graphical interface and provide editing functions to allow users to fine-tune them as needed.

5. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 4, characterized in that: The implementation steps of step S5 are: S5.

1. Read the device record and identify the type of each device; S5.

2. Select the appropriate policy script template from the script library based on the device type; S5.

3. Fill the security policy rules generated in step S4 into the script template and adjust the parameters and commands in the script according to the device characteristics; S5.

4. Compile the script to generate a policy configuration script that can be executed on the target device and perform syntax checking; S5.

5. Save the generated script file to a specified location.

6. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 5, characterized in that: The implementation steps of step S6 are: S6.

1. Read the generated strategy file and load it into the comparison algorithm; S6.

2. Compare the IP addresses, port numbers, and service type objects in the policy file with the expected configuration to check for omissions or incorrect configurations. S6.

3. Summarize the comparison results and generate a detailed comparison report that identifies any inconsistencies and provides optimization suggestions. S6.

4. Make necessary adjustments and optimizations to the strategy based on the comparison report.

7. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 6, characterized in that: The implementation steps of step S7 are: S7.

1. Select the SSH, Telnet, or SNMP delivery channel and configure the connection parameters. S7.

2. Send the policy script to the target device through the selected delivery channel and monitor the delivery process; S7.

3. Log in to the target device and check whether the policy has been successfully loaded and is effective. Use commands or tools to verify the correctness of the policy configuration. S7.

4. Summarize the distribution results and generate a distribution report, which includes the distribution time, device name, distribution status and possible error information.

8. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 7, characterized in that: The implementation steps of step S8 are: S8.

1. Set up a mining task in the system, specifying the equipment to be mined, the data items, and the mining period; S8.

2. Retrieve basic information and configuration data from the device via the network or API. S8.

3. Archive the collected data into a database or file system and organize the data; S8.

4. Update the relevant information in the equipment ledger based on the recovered data.

9. The method for configuring a new site grid connection plan generation strategy based on a custom template according to claim 8, characterized in that: The implementation steps of step S9 are: S9.

1. Use graphical tools to design intuitive network topology diagrams, policy distribution maps, and device status dashboards. S9.

2. Dynamically display the configured network topology on the interface, including device connection relationships and IP address allocation; S9.

3. Display the distribution of security policies in a chart or table format, including which devices have which policies applied. S9.

4. Real-time update of device status information, including online / offline, CPU usage, and memory usage; S9.

5. Provide a feedback portal to allow users to submit comments and suggestions on the configuration effects.

Images