Network configuration auditing method, device, equipment, medium and product

Abstract

The invention provides a network configuration auditing method and device, equipment, a medium and a product, relates to the technical field of communication, and aims to solve the technical problems of low checking efficiency and low checking accuracy caused by a mode of manually checking network configuration information in the general technology. The method comprises the following steps: acquiring a device type and network configuration information of a to-be-audited network device; obtaining a target network configuration auditing template corresponding to the device type of the to-be-audited network device from a pre-established network configuration auditing template set; the network configuration auditing template set comprises network configuration auditing templates corresponding to different device types; the target network configuration auditing template comprises an auditing rule corresponding to the to-be-audited configuration parameter; and auditing the network configuration information based on the target network configuration auditing template to obtain a network configuration auditing result of the to-be-audited network equipment. According to the invention, the checking efficiency and checking accuracy of the network configuration information issued to the network equipment can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a network configuration auditing method and device, equipment, medium and product. BACKGROUND

[0002] With the development of digital economy, network has become a key infrastructure, and the scale and complexity of the services carried by the network have gradually increased. In modern network infrastructure, to cope with the increasing management needs, centralized management of network devices is realized through network management systems. For example, the software defined network (SDN) system realizes the automatic management of the configuration and service execution of network devices such as switches and routers, which brings great convenience to the operation and management of the network. Due to the complex and diverse user service needs (such as local area network connection, IPv6 adaptation, etc.), there are usually a large number of configuration issuing operations on network devices, and each network device will carry a large number of service needs. However, frequent configuration changes may affect the existing data link. In order to avoid the risk of service disconnection due to configuration problems, it is necessary to conduct compliance auditing on the configuration instructions issued by the network device.

[0003] The configuration of the network device (such as routing policy, port parameter, service deployment) directly affects the connectivity of the data link and the service availability. In a complex network, a configuration error of a single network device may affect the entire service chain through "link concatenation" (for example, a configuration error of a switch port parameter may cause the office terminals of dozens of users downstream to be disconnected); if a core node (such as a backbone router) is involved, it may even cause regional network fluctuations.

[0004] However, with the increasing complexity and scale of the network, it is increasingly difficult to manually verify the configuration instructions issued by the network device, and the manual verification method may result in incorrect configuration of the network device, which may cause network service interruption, network security vulnerabilities, and even affect user service needs, further increasing the operation and maintenance cost. SUMMARY

[0005] The embodiments of the present disclosure provide a network configuration auditing method, device, equipment, medium and product, aiming to solve the technical problems of low verification efficiency and low verification accuracy caused by manually verifying network configuration information in the prior art.

[0006] To achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0007] In a first aspect, a network configuration auditing method is provided, including: obtaining device type and network configuration information of a network device to be audited; obtaining a target network configuration auditing template corresponding to the device type of the network device to be audited from a pre-established network configuration auditing template set; the network configuration auditing template set includes network configuration auditing templates corresponding to different device types; the target network configuration auditing template includes an auditing rule corresponding to a configuration parameter to be audited; and auditing the network configuration information based on the target network configuration auditing template to obtain a network configuration auditing result of the network device to be audited.

[0008] Optionally, the network configuration auditing template set is obtained in the following manner:

[0009] Obtaining basic configuration information of a plurality of network devices and device type of each network device; and classifying and merging the basic configuration information of the plurality of network devices according to the device type of the network device to obtain a basic configuration information set of the network device corresponding to each device type.

[0010] Determining a configuration parameter in the basic configuration information set of the network device corresponding to each device type; the configuration parameter is a parameter that can be dynamically adjusted in the basic configuration information set of the network device corresponding to each device type.

[0011] Determining a basic auditing rule of the configuration parameter according to the configuration parameter in the basic configuration information set of the network device corresponding to each device type; obtaining a custom auditing rule corresponding to the configuration parameter in the basic configuration information set of the network device corresponding to each device type; and determining an auditing rule corresponding to the configuration parameter in the basic configuration information set of the network device corresponding to each device type according to the basic auditing rule and the custom auditing rule.

[0012] Determining the network configuration auditing template set according to the basic configuration information set of the network device corresponding to each device type and the auditing rule corresponding to the configuration parameter in the basic configuration information set of the network device corresponding to each device type.

[0013] Optionally, the network configuration information includes at least one network configuration type; and the auditing of the network configuration information based on the target network configuration auditing template includes:

[0014] Classifying the network configuration information according to the network configuration type in the network configuration information to obtain classified network configuration information; and in the case that the actual configuration information of the network device to be audited is not included in the classified network configuration information, auditing the classified network configuration information according to the auditing rule corresponding to the configuration parameter to be audited in the target network configuration auditing template; the actual configuration information is basic information of the network device to be audited.

[0015] Optionally, according to the audit rule corresponding to the to-be-audited configuration parameter in the target network configuration audit template, the classified network configuration information is audited, including:

[0016] According to the target network configuration audit template, the classified network configuration information is parsed to obtain the to-be-audited configuration parameter in the classified network configuration information; according to the target network configuration audit template, the audit rule corresponding to the to-be-audited configuration parameter is matched; according to the classified network configuration information and the audit rule corresponding to the to-be-audited configuration parameter, the audit information template in the preset format is generated; and according to the audit information template in the preset format, the classified network configuration information is audited.

[0017] Optionally, the preset format is the format of a markup extension language XML.

[0018] Optionally, the network configuration auditing method further includes:

[0019] In the case that the classified network configuration information includes the actual configuration information of the to-be-audited network device, the actual configuration information of the to-be-audited network device in the cache is obtained, and the classified network configuration information is audited according to the actual configuration information of the to-be-audited network device in the cache.

[0020] In a second aspect, a network configuration auditing apparatus is provided, which includes a communication unit and a processing unit; the communication unit is configured to obtain the device type and the network configuration information of a to-be-audited network device.

[0021] The processing unit is configured to obtain, from a pre-established network configuration audit template set, a target network configuration audit template corresponding to the device type of the to-be-audited network device; the network configuration audit template set includes network configuration audit templates corresponding to different device types; and the target network configuration audit template includes an audit rule corresponding to a to-be-audited configuration parameter.

[0022] The processing unit is further configured to audit the network configuration information based on the target network configuration audit template to obtain a network configuration auditing result of the to-be-audited network device.

[0023] In a third aspect, a network configuration auditing device is provided, which includes a memory and a processor; the memory is configured to store computer execution instructions, and the processor is connected to the memory through a bus; when the network configuration auditing device is running, the processor executes the computer execution instructions stored in the memory, so that the network configuration auditing device executes the network configuration auditing method of the first aspect.

[0024] The network configuration auditing device can be an electronic device or a part of an electronic device, such as a chip system in the electronic device. The chip system is configured to support the electronic device to implement the functions involved in the first aspect and any possible implementation manner thereof, for example, obtaining and determining the data and / or information involved in the network configuration auditing method. The chip system includes a chip and can further include other discrete devices or circuit structures.

[0025] In a fourth aspect, a computer-readable storage medium is provided, which includes computer-executable instructions that, when executed on a computer, cause the computer to perform the network configuration auditing method of the first aspect.

[0026] In a fifth aspect, a computer program product is also provided, which includes computer programs or instructions that, when executed on a network configuration auditing device, cause the network configuration auditing device to perform the network configuration auditing method of the first aspect.

[0027] It should be noted that the computer instructions can be stored on the computer-readable storage medium in whole or in part. The computer-readable storage medium can be packaged together with the processor of the network configuration auditing device or packaged separately from the processor of the network configuration auditing device, and the embodiments of the present application do not limit this.

[0028] The second aspect, the third aspect, the fourth aspect and the fifth aspect of the present application can refer to the detailed description of the first aspect.

[0029] In the embodiments of the present application, the name of the network configuration auditing device does not constitute a limitation on the device or functional module itself, and in actual implementation, these devices or functional modules can appear with other names. For example, the receiving unit can also be referred to as a receiving module, a receiver, etc. As long as the functions of each device or functional module are similar to those of the present application, they belong to the scope of the claims of the present application and equivalent technologies.

[0030] The technical solutions provided by the present application at least have the following beneficial effects:

[0031] Based on any of the above aspects, the embodiments of the present application provide a network configuration auditing method. First, the device type and the network configuration information of a network device to be audited are obtained. Then, a target network configuration auditing template corresponding to the device type of the network device to be audited is obtained from a pre-established network configuration auditing template set. The network configuration auditing template set includes network configuration auditing templates corresponding to different device types. The target network configuration auditing template includes an auditing rule corresponding to a configuration parameter to be audited. Second, the network configuration information is audited based on the target network configuration auditing template to obtain a network configuration auditing result of the network device to be audited.

[0032] From the above, the present application pre-constructs a network configuration auditing template set. Before auditing the network configuration information issued to the network device to be audited, the target network configuration auditing template in the network configuration auditing template set is acquired through the device type of the network device to be audited. The network configuration information issued to the network device to be audited is audited according to the target network configuration auditing template, so as to realize the verification of the network configuration information issued to the network device to be audited. The present application pre-constructs the network configuration auditing template set, realizes the auditing of the network configuration information issued to the network device to be audited, avoids the problem of low verification efficiency and easy verification error in the prior art through manual verification, and improves the verification efficiency and accuracy.

[0033] The beneficial effects of the first aspect, the second aspect, the third aspect, the fourth aspect and the fifth aspect of the present application can be referred to the analysis of the beneficial effects above, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 A structural schematic diagram of a network configuration auditing system provided by an embodiment of the present application;

[0035] Figure 2 A hardware structural schematic diagram of a network configuration auditing apparatus provided by an embodiment of the present application;

[0036] Figure 3 A flowchart of a network configuration auditing method provided by an embodiment of the present application;

[0037] Figure 4 A flowchart of a network configuration template set acquisition method provided by an embodiment of the present application;

[0038] Figure 5 A flowchart of another network configuration auditing method provided by an embodiment of the present application;

[0039] Figure 6 A flowchart of another network configuration auditing method provided by an embodiment of the present application;

[0040] Figure 7 A flowchart of another network configuration template set acquisition method provided by an embodiment of the present application;

[0041] Figure 8 A flowchart of another network configuration auditing method provided by an embodiment of the present application;

[0042] Figure 9 A structural schematic diagram of a network configuration auditing apparatus provided by an embodiment of the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work should fall within the scope of protection of the present application.

[0044] It should be noted that in the embodiments of the present application, the words such as "exemplary" or "for example" are used to mean serving as an example, illustration, or description. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present application should not be construed as being more preferred or having more advantages than other embodiments or design solutions. Rather, the words such as "exemplary" or "for example" are used in the specific manner to present the relevant concept.

[0045] In order to clearly describe the technical solutions in the embodiments of the present application, in the embodiments of the present application, the words "first", "second", and the like are used to distinguish the same or similar items or items with basically the same function and role. A person skilled in the art can understand that the words "first", "second", and the like are not used to limit the number and execution order.

[0046] Before the network configuration auditing method provided by the present application is described in detail, the application scenarios and implementation environments involved in the present application are briefly introduced.

[0047] First, the application scenarios involved in the present application are briefly introduced.

[0048] As described in the background, with the growth of the network usage scale, the business demand borne by various network devices carrying network services is also increasing. In a large-scale network, once the network configuration of the network device is wrong, it is likely to trigger a chain reaction and affect the stable operation of the entire network. Therefore, the network configuration of the network device is crucial to the safe and stable operation of the network. In the general technology, the verification of the network configuration issued to the network device depends on the manual verification mode. However, in a large-scale network scenario, manual verification is not only inefficient, but also may cause network configuration errors due to operation omissions and the like.

[0049] To address the above-mentioned issues, an embodiment of the present application provides a network configuration audit method. First, the device type and network configuration information of the network device to be audited are obtained. Then, a target network configuration audit template corresponding to the device type of the network device to be audited is obtained from a pre-established network configuration audit template set. The network configuration audit template set includes network configuration audit templates corresponding to different device types. The target network configuration audit template includes audit rules corresponding to the configuration parameters to be audited. Next, the network configuration information is audited based on the target network configuration audit template to obtain the network configuration audit results of the network device to be audited.

[0050] As can be seen from the above, the present application pre-constructs a network configuration audit template set. Before auditing the network configuration information sent to the network device to be audited, the target network configuration audit template in the network configuration audit template set is obtained according to the device type of the network device to be audited. The network configuration information sent to the network device to be audited is audited according to the target network configuration audit template, thereby realizing the verification of the network configuration information sent to the network device to be audited. The present application pre-constructs a network configuration audit template set to realize the audit of the network configuration information sent to the network device to be audited, avoiding the problems of low verification efficiency and easy verification errors in the general technology through manual verification, thereby improving the efficiency and accuracy of verification.

[0051] The implementation environment of the above-mentioned network configuration auditing method can be the network configuration auditing system provided in the embodiment of the present application.

[0052] Figure 1 FIG. 1 shows a schematic diagram of the structure of a network configuration audit system provided by an embodiment of the present application. Figure 1 As shown, the network configuration auditing system includes: a network configuration auditing device 101 and a data storage device 102 .

[0053] The network configuration auditing device 101 and the data storage device 102 are in communication connection with each other.

[0054] In practical applications, the network configuration audit device 101 can be connected to any number of data storage devices 102. Figure 1 An example of a network configuration audit device 101 connected to a data storage device 102 is used for description.

[0055] Optionally, the network configuration auditing device 101 can also connect to a network management system and the network device to be audited to obtain network configuration information sent by the network management system to the network device to be audited. The network configuration auditing device 101 can also connect to multiple network devices and obtain basic configuration information of multiple network devices based on information such as the IP addresses of the network devices.

[0056] In the embodiments of the present application, the data storage device 102 is configured to store a pre-established network configuration auditing template set.

[0057] The network configuration auditing device 101 is configured to audit the network configuration information of the network device to be audited to obtain the network configuration auditing result of the network device to be audited.

[0058] Optionally, the entity device of the network configuration auditing device 101 can be a server, a terminal, or other types of electronic devices, and the embodiments of the present application do not limit the same.

[0059] Optionally, the terminal can be a device that provides voice and / or data connectivity to users, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. The wireless terminal can communicate with one or more core networks through a radio access network (RAN). The wireless terminal can be a mobile terminal, such as a mobile phone (or called "cellular" phone) and a computer with a mobile terminal, and can also be a portable, pocket, handheld, built-in computer, or vehicle-mounted mobile device that exchanges voice and / or data with a radio access network. For example, a mobile phone, a tablet computer, a notebook computer, a netbook, a personal digital assistant (PDA).

[0060] Optionally, the server can be one server in a server cluster (composed of multiple servers), a chip in the server, a system on a chip in the server, or implemented through a virtual machine (VM) deployed on a physical machine, and the embodiments of the present application do not limit the same.

[0061] Optionally, the network configuration auditing device 101 and the data storage device 102 can be two devices independently arranged with each other, or can be integrated in the same device. When the network configuration auditing device 101 and the data storage device 102 are integrated in the same device, the data storage device 102 can be a storage module (such as a database, etc.) of the network configuration auditing device 101.

[0062] Optionally, when the network configuration auditing device 101 and the data storage device 102 are integrated in the same device, the communication mode between the network configuration auditing device 101 and the data storage device 102 is the communication between the internal modules of the device. In this case, the communication process between the two is the same as the communication process between the network configuration auditing device 101 and the data storage device 102 when they are independent of each other.

[0063] For the convenience of understanding, the network configuration auditing device 101 and the data storage device 102 are independent of each other in the present application.

[0064] The network configuration auditing device 101 in the network configuration auditing system comprises the elements as shown in the following table. Figure 2 The hardware structure of the network configuration auditing device 101 is introduced below by taking the following table as an example. Figure 2 The hardware structure of the network configuration auditing device 101 is introduced below by taking the following table as an example.

[0065] Figure 2 The hardware structure of the network configuration auditing device 101 is introduced below by taking the following table as an example.

[0066] The processor 21 is the control center of the network configuration auditing device, which can be one processor or a general term of multiple processing elements. For example, the processor 21 can be a general central processing unit (CPU), or other general-purpose processors, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0067] As an embodiment, the processor 21 can include one or more CPUs, such as the CPU0 and CPU1 shown in the following table. Figure 2

[0068] The memory 22 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0069] In a possible implementation manner, the memory 22 can exist independently of the processor 21, and the memory 22 can be connected to the processor 21 through the bus 24, for storing instructions or program codes. When the processor 21 invokes and executes the instructions or program codes stored in the memory 22, the network configuration auditing method provided in the embodiments of the present application can be implemented.

[0070] ​In the embodiments of the present application, the software programs stored in the memory 22 are different for the network configuration auditing device, so the network configuration auditing device implements different functions. The functions performed by each device will be described in conjunction with the following flowcharts.

[0071] In another possible implementation, the memory 22 can also be integrated with the processor 21.

[0072] The communication interface 23 is configured to connect the network configuration auditing device with other devices through a communication network, which can be an Ethernet, a wireless access network, a wireless local area network (WLAN), or the like. The communication interface 23 can include a receiving unit configured to receive data, and a sending unit configured to send data.

[0073] The bus 24 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, an extended industry standard architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, Figure 2 In the figure, only one thick line is used to represent the bus, but it does not mean that there is only one bus or only one type of bus.

[0074] It should be noted that Figure 2 The structure shown in the figure does not constitute a limitation on the network configuration auditing device, except Figure 2 The network configuration auditing device can include more or fewer components than shown in the figure, or combine some components, or different component arrangements.

[0075] The network configuration auditing method provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0076] The network configuration auditing method provided by the embodiments of the present application is applied to Figure 1 The network configuration auditing device 101 in the network configuration auditing system shown in the figure, such as Figure 3 The network configuration auditing method provided by the embodiments of the present application includes:

[0077] S301, obtaining the device type and network configuration information of a network device to be audited.

[0078] Specifically, before auditing the network configuration information of the audited network device, it is necessary to obtain the target network configuration audit template corresponding to the device type of the audited network device. Therefore, it is necessary to obtain the device type and network configuration information of the audited network device.

[0079] Optionally, the network device to be audited may be a switch, router, or other hardware device used for network connection, network transmission, and network management.

[0080] Optionally, the network configuration information may be the network configuration information issued by the network management system to the corresponding network device. The network configuration information includes the configuration content issued by the network management system based on the customer's business needs (i.e., including configuration instructions for the network device, such as network protocol configuration, network device interface configuration, and bandwidth rule configuration, etc.).

[0081] Optionally, the network configuration auditing device can obtain the device type of the network device to be audited through the Internet Protocol (IP) address of the network device to be audited. The network configuration auditing device can obtain the network configuration information sent to the network device to be audited by the network management system by connecting to the network management system.

[0082] For example, a software-defined network (SDN) system sends network configuration information to network devices. Configuration instructions are sent to network devices through application programming interfaces (APIs), such as device interface IP configuration, virtual local area network (VLAN) creation, and other specific configuration contents (usually encapsulated in a structured format such as JSON or XML). After receiving the instructions, the network device parses the configuration contents through its built-in protocol stack and extracts the network configuration information to be executed.

[0083] S302: Obtain a target network configuration audit template corresponding to the device type of the network device to be audited from a pre-established network configuration audit template set.

[0084] The network configuration audit template set includes network configuration audit templates corresponding to different device types. The target network configuration audit template includes audit rules corresponding to the configuration parameters to be audited.

[0085] Specifically, the pre-established network configuration audit template set includes network configuration audit templates corresponding to different device types. Therefore, it is necessary to obtain the target network configuration audit template corresponding to the device type of the network device to be audited.

[0086] Optionally, the configuration parameters to be audited are parameters that are specifically configured on the network device to be audited in the network configuration information.

[0087] Optionally, the pre-established network configuration auditing template can be stored in a data storage device (such as a database), and the target network configuration auditing template corresponding to the device type of the network device to be audited can be obtained through the device type of the network device to be audited.

[0088] S303, auditing the network configuration information based on the target network configuration auditing template to obtain the network configuration auditing result of the network device to be audited.

[0089] Specifically, the target network configuration auditing template includes the auditing rule corresponding to the configuration parameter to be audited, and therefore, the network configuration information can be audited through the target network configuration auditing template.

[0090] Optionally, the network configuration information is audited through the auditing rule corresponding to the configuration parameter to be audited in the target network configuration auditing template, and the auditing result (including the information checked normally and the error information) is returned to the system of issuing the network configuration information, so that the subsequent system or personnel can analyze or adjust the issued network configuration information according to the auditing result.

[0091] In some embodiments, as shown in Figure 4 The network configuration auditing template set is obtained in the following manner:

[0092] S401, obtaining the basic configuration information of a plurality of network devices and the device type of each network device.

[0093] Specifically, the network configuration set template set needs to be constructed according to the full configuration of the network device, because the basic configuration information of different types of network devices is different, and therefore, the device type of each network device needs to be obtained for distinguishing the basic configuration information of different types of network devices.

[0094] Optionally, the basic configuration information of the network device represents the configuration information already existing and running in the network device, for example, the configuration information of the physical interface of the network device, the static routing configuration information of the network device, etc.

[0095] Exemplarily, the network device can be a switch or a router or other types of network devices. When the network device is a switch, the basic configuration information of the switch can include the configuration of the physical port state of the switch, the port link type configuration of the switch, and the creation configuration of the VLAN, etc. When the network device is a router, the basic configuration information of the router can include the IP setting of the physical interface of the router, the static routing configuration, the network address translation configuration, etc.

[0096] S402, classifying and merging the basic configuration information of a plurality of network devices according to the device type of the network device to obtain the basic configuration information set of the network device corresponding to each device type.

[0097] Specifically, because the basic configuration information of different types of network devices is different, it is necessary to classify the obtained basic configuration information of multiple network devices according to the device type of the network device. By merging the basic configuration information of the same device type, the full-amount configuration information of the network device corresponding to each device type can be ensured.

[0098] For example, the basic configuration information of the same device type is merged, and the specific processing process is as follows:

[0099] First, the basic configuration information of the network device with different configuration contents is classified according to the configuration content. For example, the following basic IPv4 address family VPN routing configuration and IPv4 address family "traffic specification" related VPN routing configuration are both related configurations of IPv4 for routers (i.e., the same type of network device) (i.e., the same configuration for the network device).

[0100] (1) Basic IPv4 address family VPN routing configuration

[0101] address-family ipv4

[0102] route-distinguisher 65402:18020

[0103] apply-label per-instance

[0104] (2) IPv4 address family "traffic specification" related VPN routing configuration

[0105] address-family ipv4flowspec

[0106] route-distinguisher 65402:18021

[0107] Then, the basic configuration information with the same configuration content is merged, and the variable parameters (also referred to as variable values) in the merged basic configuration information are marked. For example, the configuration information of the above basic IPv4 address family VPN routing configuration and the IPv4 address family "traffic specification" related VPN routing configuration is merged into one configuration set, and the variable parameters "flowspec", "18020" in the merged configuration set are marked as "*".

[0108] Merged configuration set:

[0109] address-family ipv4flowspec*

[0110] route-distinguisher 65402:18020*

[0111] apply-label per-instance

[0112] Secondly, the basic configuration information of the network device of the same device type after the above process is classified and processed is determined as the basic configuration information set of the network device corresponding to the device type. The basic configuration information set of the network device corresponding to each device type is determined in turn.

[0113] S403, determine the configuration parameter in the basic configuration information set of the network device corresponding to each device type.

[0114] Among them, the configuration parameter is the parameter that can be dynamically adjusted in the basic configuration information set of the network device corresponding to each device type.

[0115] Specifically, because the configuration parameter in the basic configuration information set of the network device corresponding to each device type is the specific variable parameter that needs to be configured for the network device, and other configuration information in the basic configuration information set is fixed content, therefore, it is necessary to obtain the configuration parameter in the basic configuration information set of the network device corresponding to each device type, in order to subsequently audit according to the configuration parameter.

[0116] For example, the configuration parameter can be the variable parameter (the parameter marked with "*" in the above S402 example) in the above S402 example. Loop processing is performed on the basic configuration information set of the network device corresponding to each device type, and the fixed value (such as "address-family ipv4" and "route-distinguisher" in the above S402 example) corresponding to the configuration parameter in the basic configuration information set of the network device corresponding to each device type is marked as Key, that is, configBlockCommandKey, so as to be matched with the configuration parameter subsequently according to the fixed value.

[0117] S404, according to the configuration parameter in the basic configuration information set of the network device corresponding to each device type, determine the basic audit rule of the configuration parameter.

[0118] Specifically, according to the configuration parameter in the basic configuration information set of the network device corresponding to each device type, the basic audit rule corresponding to the configuration parameter is generated, which is used for subsequent audit rule determined according to the basic audit rule.

[0119] Optionally, the basic audit rule can be generated according to the type of the configuration parameter. The type of the configuration parameter can be a text or a number type or an IP setting. The corresponding regular expression is generated according to the type of the configuration parameter. For example, the configuration parameter is a string composed of multiple numbers (such as "100"), and the generated primary regular expression can be "^[0-9]+$", which represents a string composed of numbers.

[0120] S405, obtain the custom audit rule corresponding to the configuration parameter in the basic configuration information set of the network device corresponding to each device type.

[0121] Specifically, according to the configuration parameter in the basic configuration information set of the network device corresponding to each device type, the verification rule of the configuration parameter can be customized according to the business requirements to obtain the custom audit rule.

[0122] Optionally, the configuration parameter in the basic configuration information set of the network device determined in S403 and the basic configuration information set of the network device are parsed and presented to the user in a visual manner. The user can set the verification rule of the configuration parameter. Then, the user-defined verification rule is obtained, and the user-defined verification rule is format-verified and a custom audit rule is generated.

[0123] S406, determine the audit rule corresponding to the configuration parameter in the basic configuration information set of the network device corresponding to each device type according to the basic audit rule and the custom audit rule.

[0124] As can be seen from the above, the audit rule corresponding to the configuration parameter determined according to the basic audit rule and the custom audit rule can not only ensure that the configuration parameter meets the actual specification of the device (such as the format requirement of the parameter), but also support ensuring that the configuration parameter meets the actual business requirements (such as whether to verify the configuration parameter).

[0125] S407, determine the network configuration audit template set according to the basic configuration information set of the network device corresponding to each device type and the audit rule corresponding to the configuration parameter in the basic configuration information set of the network device corresponding to each device type.

[0126] Specifically, the basic audit rule and the custom audit rule corresponding to the configuration parameter in the basic configuration information set of the network device corresponding to each device type are respectively stored with the basic configuration information set of the network device corresponding to each device type (including the fixed value corresponding to the configuration parameter in the basic configuration information set) to obtain the network configuration audit template set.

[0127] From the above, by storing the basic audit rules determined based on the device self rules and the custom audit rules determined according to the business requirements respectively, the compliance of the network configuration information can be ensured when subsequent auditing is performed according to the network configuration audit template set.

[0128] In some embodiments, in combination Figure 3 As Figure 5 shown, in S303, the network configuration information includes at least one network configuration type; and the network configuration information is audited based on the target network configuration audit template, including:

[0129] S501, according to the network configuration type in the network configuration information, the network configuration information is classified and processed to obtain the classified network configuration information.

[0130] Specifically, because the network configuration information issued to the network device to be audited includes at least one network configuration type. When the issued network configuration information includes multiple network configuration types, the issued network configuration information is usually issued according to the business requirements, and is not issued according to the type of network configuration, therefore, the issued network configuration information needs to be classified and processed according to the network configuration type.

[0131] Optionally, the network configuration information includes at least one network configuration type, for example: the issued network configuration information includes interface IP configuration, VLAN creation, routing rule configuration, etc. of the network device to be audited.

[0132] From the above, after the network configuration information is classified and processed, the subsequent auditing according to the classified and processed network configuration information can improve the auditing speed.

[0133] S502, in the case that the classified network configuration information does not include the actual configuration information of the network device to be audited, the classified network configuration information is audited according to the audit rule corresponding to the to-be-audited configuration parameter in the target network configuration audit template.

[0134] Among them, the actual configuration information is the basic information of the network device to be audited.

[0135] Specifically, when the classified network configuration information does not include the actual configuration information of the network device to be audited, i.e. does not involve the verification of the actual configuration information of the device, the classified network configuration information can be audited according to the audit rule corresponding to the to-be-audited configuration parameter in the target network configuration audit template, to implement the auditing of the classified network configuration information.

[0136] Optionally, the actual configuration information of the network device to be audited can be the device identifier of the network device to be audited, such as the IP address and other information of the network device to be audited.

[0137] In some embodiments, the combination Figure 5 As Figure 6 As shown in S502, the network configuration information is audited according to the audit rules corresponding to the to-be-audited configuration parameters in the target network configuration audit template.

[0138] S601, according to the target network configuration audit template, the classified network configuration information is parsed to obtain the to-be-audited configuration parameters in the classified network configuration information.

[0139] Specifically, the target network configuration audit template includes the basic configuration information of the device corresponding to the device type of the to-be-audited network device, so that the classified network configuration information can be parsed through the target network configuration audit template. The to-be-audited configuration parameters in the classified network configuration information are specific parameters that need to be set for the to-be-audited network device, so the to-be-audited configuration parameters in the classified network configuration information need to be obtained for subsequent auditing of the classified network configuration information.

[0140] Optionally, the to-be-audited configuration parameter is a parameter (also referred to as a variable value) for configuring the to-be-audited network device in the classified network configuration information. As the variable parameter in S402.

[0141] Optionally, the to-be-audited configuration parameter in the classified network configuration information can be matched through the fixed value corresponding to the configuration parameter in the basic configuration information set of the device in the target network configuration audit template.

[0142] S602, according to the target network configuration audit template, the audit rule corresponding to the to-be-audited configuration parameter is matched.

[0143] Specifically, the to-be-audited configuration parameter needs to be verified according to the audit rule corresponding to the to-be-audited configuration parameter, so the audit rule corresponding to the to-be-audited configuration parameter needs to be obtained.

[0144] Optionally, as known from S601, the to-be-audited configuration parameter in the classified network configuration information can be obtained according to the target network configuration audit template. Correspondingly, the audit rule in the target network configuration audit template also corresponds to the configuration parameter in the target network configuration audit template, so after the to-be-audited configuration parameter in the classified network configuration information is matched, the audit rule corresponding to the to-be-audited parameter can be obtained.

[0145] S603, according to the classified network configuration information and the audit rule corresponding to the to-be-audited configuration parameter, a preset format of audit information template is generated.

[0146] Specifically, after obtaining the to-be-audited configuration parameter in the classified network configuration information and the corresponding audit rule, an audit information template in a preset format is generated, so as to subsequently complete the audit of the classified network configuration information based on the audit information template in the preset format.

[0147] For example, according to the classified network configuration information, a data format in which the to-be-audited configuration parameter and the corresponding fixed value are taken as a primary key and the audit rule corresponding to the to-be-audited configuration parameter is taken as a matching rule is used to cyclically generate the audit information template in the preset format. For example, when implementing IPv6 route forwarding and link state monitoring across network segments, the router is configured as follows:

[0148]

[0149] According to the configuration information of the above-mentioned router configuration, the variable parameters in the configuration information for enabling IPv6 of the router include: “xgei-0 / 0 / 1 / 2” (interface configuration), “10” in “min-tx 10” (indicating that the BFD negotiation parameter is configured, and the minimum sending interval is 10 ms), “10” in “min-rx 10” (indicating that the BFD negotiation parameter is configured, and the minimum receiving interval is 10 ms), “3” in “multiplier 3” (indicating that the BFD negotiation parameter is configured, and the detection multiple is 3), and “3000” in “increase 3000” (indicating that the measurement value of the link damping is increased by 3000). Therefore, the variable parameters in the configuration information are the to-be-audited configuration parameters of the above-mentioned configuration information of the router configuration.

[0150] The data format used to generate the audit information template in the preset format is defined as follows:

[0151]

[0152]

[0153] According to the above-mentioned data format and the above-mentioned configuration information of the router configuration and the to-be-audited configuration parameters of the configuration information and the audit rules corresponding to the to-be-audited configuration parameters, the following audit information template in the preset format is generated:

[0154]

[0155]

[0156] Subsequently, the above-mentioned configuration information of the router configuration can be audited according to the above-mentioned audit information template in the preset format.

[0157] S604, according to the audit information template of the preset format, the classified network configuration information is audited.

[0158] Specifically, the network configuration audit device identifies the audit information template information of the preset format, and realizes the audit of the classified network configuration information.

[0159] As can be seen, the preset format audit information template in the above S603 example can be generated, and the template information is read by the program for verification, so as to realize the audit of the classified network configuration information. The above audit method of the network device to be audited can be executed by the program, and the classified network configuration information of the network device to be audited can be audited automatically. Compared with the manual verification method in the prior art, the verification efficiency and accuracy of the classified network configuration information of the network device to be audited are improved, and a large amount of manual operation and maintenance cost is saved.

[0160] In some embodiments, the preset format is an EXtensible Markup Language (XML) format.

[0161] As can be seen, XML is a data representation format, which can be used for data transmission and storage. Users can customize tags and attributes in XML data format according to scenarios. The application generates an XML format template of the classified network configuration information to be audited and the classified network configuration information to be audited by pre-setting the tag and attribute format in the XML data format. The network configuration audit device can audit the classified network configuration information according to the generated XML format template, and the verification efficiency of the classified network configuration information is improved.

[0162] In some embodiments, the network configuration audit method further comprises:

[0163] In the case that the classified network configuration information includes the actual configuration information of the network device to be audited, the actual configuration information of the network device to be audited in the cache is obtained, and the classified network configuration information is audited according to the actual configuration information of the network device to be audited in the cache.

[0164] Specifically, when the classified network configuration information includes the actual configuration information of the network device to be audited, i.e. the verification of the actual configuration information of the device is involved, the actual configuration information of the network device to be audited stored in the cache can be directly obtained, and the classified network configuration information is audited according to the actual configuration information of the network device to be audited.

[0165] Exemplarily, before the classified network configuration information is audited according to the auditing rule corresponding to the to-be-audited configuration parameter in the auditing template according to the target network configuration in S502, if the classified network configuration information includes the actual configuration information of the to-be-audited network device, that is, the verification of the actual configuration information of the device is involved.

[0166] Firstly, the to-be-audited network device is marked and locked to prevent other business requests from changing the actual configuration information of the to-be-audited network device at the same time, resulting in inconsistency when the classified network configuration information is verified according to the actual configuration information of the to-be-audited network device.

[0167] Then, the actual configuration information (such as the IP of the to-be-audited network device) of the to-be-audited network device cached in the network configuration auditing device is obtained, and the to-be-audited configuration parameter in the classified network configuration information related to the actual configuration information of the to-be-audited network device is verified according to the actual configuration information of the to-be-audited network device, without generating an auditing information template again to audit the classified network configuration information according to the generated auditing information template.

[0168] When the classified network configuration information is audited, the to-be-audited network device marked and locked is unlocked.

[0169] Exemplarily, Figure 7 Another flowchart for obtaining a network configuration template set is shown. As shown in Figure 7 The network configuration template set is obtained in the following manner:

[0170] S701, obtaining basic configuration information of a network device.

[0171] Specifically, as in S401, the existing basic configuration information of a plurality of network devices is obtained according to the network device IP and other information, which serves as the basis for subsequent construction of a network configuration auditing template set.

[0172] S702, basic configuration information parsing and blocking.

[0173] Specifically, the basic configuration information of a plurality of network devices obtained in S701 is classified and processed. As in S402, the basic configuration information of network devices of the same type and with the same configuration content is obtained.

[0174] S703, same type configuration information parsing and merging.

[0175] Specifically, the basic configuration information of the network device of the same type obtained in S703 is merged to obtain the basic configuration information set of the device corresponding to each device type, such as the basic configuration information set of the network device corresponding to each device type obtained in S402.

[0176] S704, whether the configuration cycle is completed.

[0177] Specifically, the basic configuration information set of the device corresponding to each device type obtained in S703 is parsed in a loop, and the specific parsing process is as follows: the process of S705 and S706, to complete the parsing of the basic configuration information set. Determine whether the basic configuration information set of the device corresponding to each device type is parsed in a loop, if completed, execute the following S707 process, if not completed, continue to execute the following S705 and S706 processes to complete the parsing of the basic configuration information set of the device corresponding to each device type.

[0178] S705, Key analysis and record.

[0179] Specifically, the configuration parameters in the basic configuration information set of the device corresponding to each device type obtained in S703 are obtained, and the fixed value corresponding to the configuration parameter is marked as "*" and set as Key (that is, configBlockCommandKey). As described above in S403, determine the configuration parameters in the basic configuration information set of the network device corresponding to each device type.

[0180] S706, Value initial judgment.

[0181] Specifically, the configuration parameters corresponding to the Key obtained in S705 are parsed to generate a primary regular expression. As described above in S404, according to the configuration parameters in the basic configuration information set of the network device corresponding to each device type, the basic audit rule of the configuration parameter is determined.

[0182] S707, user confirmation and modification.

[0183] Specifically, the basic configuration information of the network device parsed in a loop in S704, S705, and S706 is presented to the user in a visual manner, and the user can add and edit the basic configuration information of the network device parsed in a loop to obtain a template modified by the user. As described above in S405, obtain the custom audit rule corresponding to the configuration parameter in the basic configuration information set of the network device corresponding to each device type.

[0184] Optionally, the editing the parsed basic configuration information of the network device includes a set of basic configuration information of the network device corresponding to each device type, a configuration parameter in the set of basic configuration information of the network device corresponding to each device type, and a primary regular expression corresponding to the configuration parameter.

[0185] S708, verifying the rule record.

[0186] Specifically, the template modified by the user in the above S707 is stored for subsequent auditing according to the stored template, such as the above S407, determining the network configuration auditing template set.

[0187] Exemplarily, Figure 8 A flowchart of another network configuration auditing method provided by an embodiment of the application is shown. As shown in the figure, Figure 8 The method includes:

[0188] S801, querying the model of the network device to be audited.

[0189] Specifically, the model of the network device to be audited is queried according to the IP information of the network device to be audited, and the device type of the network device to be audited is obtained for subsequent use in obtaining the template corresponding to the network device to be audited, such as the above S301.

[0190] S802, obtaining the template of the network device to be audited.

[0191] Specifically, the template matched with the device type of the network device to be audited is determined, and the obtained template is used for subsequent auditing of the network configuration information, such as the above S302, from the pre-established network configuration auditing template set, the target network configuration auditing template corresponding to the device type of the network device to be audited is obtained.

[0192] S803, classifying the network configuration information.

[0193] Specifically, because the network management system may issue network configuration information according to actual business needs when issuing network configuration information to the network device to be audited, rather than issuing the configuration information in order according to the same type, it is necessary to classify the issued network configuration information to obtain the classified network configuration information, and improve the speed of subsequent parsing of the classified network configuration information, such as the above S501, the network configuration information is classified according to the network configuration type in the network configuration information, to obtain the classified network configuration information.

[0194] S804, circulating the classified network configuration information.

[0195] Specifically, the classified network configuration information determined in S803 is processed in a loop.

[0196] S805, whether the classified network configuration information involves device configuration.

[0197] Specifically, it is checked whether the classified network configuration information involves checking the actual configuration information of the network device to be audited. If so, the process S806 is executed. If not, the process S808 is executed.

[0198] S806, mark the network device to be audited as locked.

[0199] Specifically, if the classified network configuration information involves checking the actual configuration information of the network device to be audited, the network device to be audited is marked as locked to prevent other business requests from changing the network device to be audited at the same time, resulting in inconsistent device configuration information verification.

[0200] S807, cache the configuration of the network device to be audited.

[0201] Specifically, according to the device information of the network device to be audited, the actual configuration information related to the network device to be audited is read and cached. Since the actual configuration information of the network device to be audited may change after this verification, only the actual configuration information of the network device to be audited is cached. If the actual configuration information of the network device to be audited is still involved in the next verification, the actual configuration information of the network device to be audited is obtained again.

[0202] S808, loop analysis of the classified network configuration information.

[0203] Specifically, it is determined whether the classified network configuration information of the current loop is completed. If so, the process S814 is executed. If not, the process S809 is executed to continue to loop and analyze the classified network configuration information.

[0204] S809, match the template Key.

[0205] Specifically, according to the template of the network device to be audited obtained in S802, the actual Key (i.e. the configuration parameter to be audited in the classified network configuration information, as described in S601 above) in the classified network configuration information is matched, and the rule corresponding to the matched Key in the template of the network device to be audited is read, which is used for subsequent verification of the classified network configuration information according to the rule corresponding to the Key. As described in S602 above, according to the target network configuration audit template, the audit rule corresponding to the configuration parameter to be audited is matched.

[0206] S810, template rule checking.

[0207] Specifically, the rule corresponding to the Key matched in S809 is checked. Since the Key is determined by the configuration parameter and the fixed prefix corresponding to the configuration parameter, the fixed prefix is excluded, and the configuration parameter in the Key is checked by the checking rule matched in S809. As described in S604, the classified network configuration information is audited according to the audit information template of the preset format. The checking rule is usually a regular expression, which is used to verify whether the actual configuration parameter conforms to the rule.

[0208] S811, to-be-audited network device configuration checking.

[0209] Specifically, if the checking rule involves the actual configuration information of the to-be-audited network device, the existing actual configuration information of the to-be-audited network device is checked according to the cached existing actual configuration information. The usual checking rule is a regular expression.

[0210] S812, checking whether the checking is passed.

[0211] Specifically, the checking is verified according to the checking results of S810 and S811. If the checking is passed, S808 is executed. If the checking is not passed, S813 is executed.

[0212] S813, checking result collection.

[0213] Specifically, if the checking is not passed, the checking results of S810 and S811 (including all error information of the network configuration information checked) are collected.

[0214] S814, marking the device as unlocked.

[0215] Specifically, after the classified network configuration information in the current cycle is checked, all the to-be-audited network devices involved are marked as unlocked.

[0216] S815, checking result return.

[0217] Specifically, the checking results of the network configuration information issued to the to-be-audited network device and the error information are returned to the network management system issuing the network configuration information, so that the system can analyze and adjust according to the returned checking results of the network configuration information.

[0218] The above describes the solutions provided by the embodiments of the present application from the method aspect. To implement the above functions, the hardware structure and / or software module corresponding to each function are included. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of the examples described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is implemented in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0219] The embodiments of the present application can divide the functional modules of the network configuration auditing device according to the above method examples. For example, each functional module can be divided according to each function, or two or more functions can be integrated in one processing module. The above integrated module can be implemented in the form of hardware or software functional module. Optionally, the division of the modules in the embodiments of the present application is illustrative, and is only a logical function division. In actual implementation, another division method can be used.

[0220] Figure 9 A structure diagram of a network configuration auditing device provided by an embodiment of the present application is shown. As shown in the figure, Figure 9 The network configuration auditing device includes a communication unit 901 and a processing unit 902.

[0221] The communication unit 901 is configured to acquire the device type and network configuration information of a network device to be audited.

[0222] The processing unit 902 is configured to acquire, from a pre-established network configuration auditing template set, a target network configuration auditing template corresponding to the device type of the network device to be audited.

[0223] The network configuration auditing template set includes network configuration auditing templates corresponding to different device types. The target network configuration auditing template includes an auditing rule corresponding to the configuration parameter to be audited.

[0224] The processing unit 902 is further configured to audit the network configuration information based on the target network configuration auditing template, to obtain a network configuration auditing result of the network device to be audited.

[0225] Optionally, the processing unit 902 is specifically configured to:

[0226] Acquire the basic configuration information of a plurality of network devices and the device type of each network device.

[0227] According to the device type of the network device, the basic configuration information of the plurality of network devices is classified and merged to obtain a set of basic configuration information of the network device corresponding to each device type.

[0228] Determine the configuration parameters in the set of basic configuration information of the network device corresponding to each device type.

[0229] Among them, the configuration parameter is a parameter that can be dynamically adjusted in the set of basic configuration information of the network device corresponding to each device type.

[0230] According to the configuration parameters in the set of basic configuration information of the network device corresponding to each device type, determine the basic audit rule of the configuration parameters.

[0231] Obtain the custom audit rule corresponding to the configuration parameters in the set of basic configuration information of the network device corresponding to each device type.

[0232] According to the basic audit rule and the custom audit rule, determine the audit rule corresponding to the configuration parameters in the set of basic configuration information of the network device corresponding to each device type.

[0233] According to the set of basic configuration information of the network device corresponding to each device type, and the audit rule corresponding to the configuration parameters in the set of basic configuration information of the network device corresponding to each device type, determine the network configuration audit template set.

[0234] Optionally, the processing unit 902 is specifically configured to:

[0235] According to the network configuration type in the network configuration information, the network configuration information is classified and processed to obtain the classified network configuration information.

[0236] In the case that the actual configuration information of the network device to be audited is not included in the classified network configuration information, the classified network configuration information is audited according to the audit rule corresponding to the configuration parameters to be audited in the target network configuration audit template.

[0237] Among them, the actual configuration information is the basic information of the network device to be audited.

[0238] Optionally, the processing unit 902 is specifically configured to:

[0239] According to the target network configuration audit template, the classified network configuration information is parsed to obtain the configuration parameters to be audited in the classified network configuration information.

[0240] According to the target network configuration audit template, the audit rule corresponding to the configuration parameters to be audited is matched.

[0241] According to the classified network configuration information and the audit rule corresponding to the to-be-audited configuration parameter, a preset format audit information template is generated.

[0242] According to the audit information template in the preset format, the classified network configuration information is audited.

[0243] Optionally, the preset format is an extensible markup language (XML) format.

[0244] Optionally, the network configuration auditing method further comprises:

[0245] In the case that the classified network configuration information comprises actual configuration information of the to-be-audited network device, the actual configuration information of the to-be-audited network device in the cache is acquired, and the classified network configuration information is audited according to the actual configuration information of the to-be-audited network device in the cache.

[0246] The embodiment of the application further provides a computer readable storage medium, which comprises computer execution instructions, and when the computer execution instructions run on a computer, the computer execution instructions make the computer execute the network configuration auditing method provided in the above embodiment.

[0247] The embodiment of the application further provides a computer program, which can be directly loaded into a memory and comprises software codes, and the computer program can realize the network configuration auditing method provided in the above embodiment after being loaded and executed by a computer.

[0248] Those skilled in the art can realize that the functions described in the above one or more examples can be realized by hardware, software, firmware or any combination thereof. When realized by software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium. The computer readable medium comprises a computer readable storage medium and a communication medium, wherein the communication medium comprises any medium facilitating the transmission of computer programs from one place to another. The storage medium can be any available medium accessible by a general or special purpose computer.

[0249] Through the description of the above embodiments, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional modules is taken as an example for illustration, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0250] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented by other manners. For example, the apparatus embodiments described above are merely illustrative, for example, the division of the modules or units is merely a logical function division, and actual implementation can have another division manner. For example, multiple units or components can be combined or integrated into another apparatus, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, apparatuses or units, which can be electrical, mechanical or other forms. The units described as separate components can be or can not be physically separated, and the components shown as units can be one physical unit or multiple physical units, that is, can be located in one place or can be distributed to multiple different places. Some or all units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0251] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit. When the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application essentially or the part that contributes to the general technology or the whole or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to make an apparatus (which can be a single chip, a chip, etc.) or a processor execute all or part of the steps of the method described in the embodiments of the present application. The storage medium mentioned above includes: a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, and various program code storage media.

[0252] The above is merely a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in the present application can be easily thought by those skilled in the art, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A network configuration audit method, characterized in that: include: Obtain the device type and network configuration information of the network device to be audited; Obtaining a target network configuration audit template corresponding to the device type of the network device to be audited from a pre-established network configuration audit template set; The network configuration audit template set includes network configuration audit templates corresponding to different device types; The target network configuration audit template includes: audit rules corresponding to the configuration parameters to be audited; The network configuration information is audited based on the target network configuration audit template to obtain a network configuration audit result of the network device to be audited.

2. The method according to claim 1, characterized in that The network configuration audit template set is obtained in the following way: Obtain basic configuration information of multiple network devices and the device type of each network device; Classify and merge the basic configuration information of the plurality of network devices according to the device types of the network devices to obtain a set of basic configuration information of the network devices corresponding to each device type; Determining a configuration parameter in a basic configuration information set of the network device corresponding to each device type; the configuration parameter is a dynamically adjustable parameter in the basic configuration information set of the network device corresponding to each device type; Determining basic audit rules for the configuration parameters according to the configuration parameters in the basic configuration information set of the network device corresponding to each device type; Obtaining custom audit rules corresponding to configuration parameters in the basic configuration information set of the network device corresponding to each device type; Determining, based on the basic audit rules and the custom audit rules, audit rules corresponding to the configuration parameters in the basic configuration information set of the network device corresponding to each device type; The network configuration audit template set is determined based on the basic configuration information set of the network device corresponding to each device type and the audit rules corresponding to the configuration parameters in the basic configuration information set of the network device corresponding to each device type.

3. The method according to claim 1, characterized in that The network configuration information includes at least one network configuration type; and auditing the network configuration information based on the target network configuration audit template includes: Classifying the network configuration information according to the network configuration type in the network configuration information to obtain classified network configuration information; In the case that the classified network configuration information does not include the actual configuration information of the network device to be audited, the classified network configuration information is audited according to the audit rules corresponding to the configuration parameters to be audited in the target network configuration audit template; the actual configuration information is the basic information of the network device to be audited.

4. The method according to claim 3, characterized in that Auditing the classified network configuration information according to the audit rules corresponding to the configuration parameters to be audited in the target network configuration audit template includes: parsing the classified network configuration information according to the target network configuration audit template to obtain the configuration parameters to be audited in the classified network configuration information; According to the target network configuration audit template, matching the audit rules corresponding to the configuration parameters to be audited; Generating an audit information template in a preset format according to the classified network configuration information and the audit rules corresponding to the configuration parameters to be audited; The classified network configuration information is audited according to the audit information template in the preset format.

5. The method according to claim 4, characterized in that The preset format is the format of XML.

6. The method according to claim 3, characterized in that Also includes: When the classified network configuration information includes the actual configuration information of the network device to be audited, the actual configuration information of the network device to be audited in the cache is obtained, and the classified network configuration information is audited based on the actual configuration information of the network device to be audited in the cache.

7. A network configuration auditing device, characterized in that: The device includes: a communication unit and a processing unit; The communication unit is used to obtain the device type and network configuration information of the network device to be audited; The processing unit is configured to obtain a target network configuration audit template corresponding to the device type of the network device to be audited from a pre-established network configuration audit template set; the network configuration audit template set includes network configuration audit templates corresponding to different device types; the target network configuration audit template includes audit rules corresponding to the configuration parameters to be audited; The processing unit is further configured to audit the network configuration information based on the target network configuration audit template to obtain a network configuration audit result of the network device to be audited.

8. A network configuration auditing device, characterized in that: include: A processor and a memory; wherein the memory is used to store one or more programs, and the one or more programs include computer-executable instructions. When the device is running, the processor executes the computer-executable instructions stored in the memory to enable the device to perform the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that When the computer-executable instructions stored in the computer-readable storage medium are executed by a processor of a network configuration auditing device, the network configuration auditing device can perform the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises a computer program or instructions, which, when executed on a computer, causes the computer to perform the method according to any one of claims 1 to 6.

Images