Automatic configuration compliance checking method and device

Abstract

The invention provides an automatic configuration compliance checking method and device, provides a one-stop network equipment automatic configuration compliance checking capability, realizes automatic checking of configuration compliance and safety of network equipment of a scheduling data network and a comprehensive data network based on construction of a multi-dimensional compliance rule base, saves manpower resource investment of checking work, and improves working efficiency. And meanwhile, the accuracy of checking work is improved.

Description

Technical Field

[0001] The embodiments of this application belong to the field of network security technology, and in particular relate to an automated configuration compliance verification method and apparatus. Background Technology

[0002] Currently, when conducting compliance checks on the network equipment configurations of the backbone dispatch data network and the backbone integrated data network, it is necessary to manually check each device and each item, which requires a lot of manpower and time. In addition, there are problems of omissions and errors in the checks, which has a significant impact on the routine implementation of network equipment configuration compliance checks. Summary of the Invention

[0003] To solve or alleviate problems in existing technologies.

[0004] Firstly, embodiments of this application provide an automated configuration compliance verification method, including:

[0005] Log in to the equipment to be inspected using the SSH protocol to collect equipment configuration information;

[0006] The equipment configuration information of the equipment to be inspected is parsed;

[0007] Select the corresponding inspection rule based on the parsed device configuration information;

[0008] Obtain inspection tasks and inspect the equipment configuration information according to the inspection rules;

[0009] The selected inspection rules will be sent to the equipment to be inspected.

[0010] Obtain the inspection report obtained by inspecting the equipment to be inspected according to the inspection rules.

[0011] As a preferred embodiment of this application, the method further includes:

[0012] Establish a mapping relationship between the types of equipment to be inspected and the inspection rules.

[0013] As a preferred embodiment of this application, the method further includes:

[0014] Identify whether all the equipment to be inspected is of the same type;

[0015] If so, select an inspection template that matches the type of the equipment to be inspected, the inspection template being assembled according to the inspection rules.

[0016] As a preferred embodiment of this application, before logging into the device to be inspected using the SSH protocol to collect device configuration information, the following steps are included:

[0017] Determine if the equipment to be inspected is online;

[0018] If not, the device to be inspected will be set to an abnormal state for collecting configuration information after a preset time period.

[0019] As a preferred embodiment of this application, after obtaining the inspection report obtained from inspecting the equipment to be inspected according to the inspection rules, the process includes:

[0020] Determine whether the content of the inspection report is standardized enough;

[0021] If not, the non-standard content in the inspection report will be processed according to the preset processing method.

[0022] As a preferred embodiment of this application, the preset processing method includes automatic removal of spaces by converting letter case and automatically cleaning up spaces.

[0023] As a preferred embodiment of this application, after obtaining the inspection report obtained from inspecting the equipment to be inspected according to the inspection rules, the process includes:

[0024] Determine whether there are any non-compliant items in the inspection report based on the verification standards;

[0025] If so, highlight it and issue a reminder for the non-compliant item on the corresponding equipment to be inspected.

[0026] Compared with the prior art, the automated configuration compliance verification method provided in this application provides a one-stop automated configuration compliance verification capability for network devices. Based on the construction of a multi-dimensional compliance rule base, it realizes automatic verification of the configuration compliance and security of network devices in scheduling data networks and integrated data networks, saving human resources for verification work and improving the accuracy of verification work.

[0027] Secondly, embodiments of this application also provide an automated configuration compliance verification device, including:

[0028] The data acquisition module is used to log in to the equipment to be inspected using the SSH protocol to collect equipment configuration information;

[0029] The parsing module is used to parse the equipment configuration information of the equipment to be inspected;

[0030] The selection module is used to select the corresponding inspection rules based on the parsed device configuration information.

[0031] The inspection module is used to acquire inspection tasks and inspect the equipment configuration information according to the inspection rules.

[0032] The distribution module is used to distribute the selected inspection rules to the equipment to be inspected.

[0033] The acquisition module is used to acquire the inspection report obtained by inspecting the equipment to be inspected according to the inspection rules.

[0034] Compared with the prior art, the beneficial effects of the automated configuration compliance verification device provided in this application embodiment are the same as the beneficial effects of the automated configuration compliance verification method provided in the first aspect, and will not be repeated here. Attached Figure Description

[0035] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. Some specific embodiments of this application will be described in detail below with reference to the accompanying drawings in an exemplary and non-limiting manner. The same reference numerals in the drawings designate the same or similar parts or components. Those skilled in the art should understand that these drawings are not necessarily drawn to scale. In the drawings:

[0036] Figure 1 This is a flowchart illustrating an automated configuration compliance verification method provided in an embodiment of this application;

[0037] Figure 2 This is a structural diagram of an automated configuration compliance verification device provided in an embodiment of this application. Detailed Implementation

[0038] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some, not all, of the embodiments of the present application. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort should fall within the scope of protection of the present application.

[0039] This application employs a microservices architecture to deploy automated inspection functionality within a comprehensive network management system. By configuring relevant indicators, it enables the verification of network device configurations. To ensure the compliance of the business platform, we will evaluate the configurations of devices such as core routers, aggregation routers, access routers, and access switches. The evaluation will cover multiple aspects, including basic configuration, network configuration, and security configuration. Based on the inspection task requirements, we will verify whether the device configurations meet the prescribed standards and generate corresponding inspection summary reports and detailed device reports to ensure device compliance.

[0040] Firstly, such as Figure 1 As shown in the embodiment of this application, an automated configuration compliance verification method is provided, including:

[0041] Step S01: Log in to the device to be inspected using the SSH protocol to collect device configuration information.

[0042] It should be noted that, through its powerful concurrency capabilities, this application achieved a configuration verification time of approximately 15 minutes for 1500 devices during the system stress test phase, completing real-time data collection from 1500 devices in 15 minutes. Under conditions of a large number of devices, numerous verification commands, and diverse device models, there were previously potential risks of batch data collection failures. By investigating and resolving these potential issues, the reliability of the system's high-concurrency, multi-command batch data collection has been better guaranteed.

[0043] Before logging into the device to be inspected using the SSH protocol to collect device configuration information, the following steps are included:

[0044] Determine if the equipment to be inspected is online;

[0045] If not, the device to be inspected will be set to an abnormal state for collecting configuration information after a preset time period.

[0046] This step can prevent delays or complete halts to the entire data collection task.

[0047] Step S02: Parse the equipment configuration information of the equipment to be inspected.

[0048] It should be noted that because the equipment configuration information of each device to be inspected is different, the equipment configuration information needs to be parsed so that the equipment configuration information can be identified during the inspection.

[0049] This application, through custom configuration verification scripts and verification objects, can cover various configuration verification scenarios and meet different configuration verification needs, such as immediate and periodic verification. These scripts can be customized according to actual needs, making configuration verification work more flexible and efficient. At the same time, the system can also automatically execute tasks according to preset configuration verification plans, greatly reducing the workload of manual verification.

[0050] Step S03: Select the corresponding inspection rule based on the parsed device configuration information;

[0051] The method further includes:

[0052] Establish a mapping relationship between the types of equipment to be inspected and the inspection rules.

[0053] It should be noted that, since a mapping relationship has been established between the type of equipment to be inspected and the inspection rules, as long as the corresponding inspection rule is selected according to the parsed equipment configuration information, the inspection rules of the equipment to be inspected can be used to inspect the equipment.

[0054] The method further includes:

[0055] Identify whether all the equipment to be inspected is of the same type;

[0056] If so, select an inspection template that matches the type of the equipment to be inspected, the inspection template being assembled according to the inspection rules.

[0057] It should be noted that different manufacturers and models of equipment will have different command inputs and information outputs for the same verification indicators. To address the issue of configuration verification needing to adapt to a large number of different manufacturers and models of equipment at the same time, the problem of adapting the same verification indicators to different commands and outputs of multiple manufacturers and models of equipment is solved by adapting the inspection commands to the different commands and outputs of multiple manufacturers and models of equipment, generating inspection rules based on the inspection commands, assembling inspection templates based on the inspection rules, and then flexibly selecting templates by the inspection tasks.

[0058] Step S04: Obtain the inspection task and perform an inspection on the equipment configuration information according to the inspection rules.

[0059] It should be noted that when it is necessary to inspect the equipment to be inspected, an inspection task is issued. The inspection task includes the items to be inspected, and then the equipment to be inspected is inspected according to the inspection rules corresponding to each piece of equipment.

[0060] By customizing inspection scripts and inspection objects, it covers inspection scenarios such as immediate and periodic inspections. Based on the inspection task plan, it realizes automated inspection and generates standard visual reports, reducing the workload of inspections and improving the effectiveness of inspections.

[0061] Step S05: Select the inspection rules and send them to the equipment to be inspected.

[0062] It should be noted that the established inspection rules will be issued to the equipment to be inspected for inspection.

[0063] Step S06: Obtain the inspection report obtained by inspecting the equipment to be inspected according to the inspection rules.

[0064] The automated configuration verification system can also generate standardized visual reports, facilitating a comprehensive understanding of the equipment's operational status. These reports not only display real-time equipment data but also perform statistical analysis, helping to promptly identify and address potential problems. Furthermore, the reports can provide alerts and notifications for abnormal data, enabling rapid response and handling of equipment malfunctions and other issues.

[0065] Automated configuration verification systems can improve equipment reliability and stability, reduce equipment failures and downtime, lower the cost and risk of manual inspections, and improve the operational efficiency of enterprises.

[0066] After obtaining the inspection report obtained from inspecting the equipment to be inspected according to the inspection rules, the process includes:

[0067] Determine whether the content of the inspection report is standardized enough;

[0068] If not, the non-standard content in the inspection report will be processed according to the preset processing method.

[0069] The preset processing methods include automatic removal of spaces by converting letter case and automatically cleaning up spaces.

[0070] After obtaining the inspection report obtained from inspecting the equipment to be inspected according to the inspection rules, the process includes:

[0071] Determine whether there are any non-compliant items in the inspection report based on the verification standards;

[0072] If so, highlight it and issue a reminder for the non-compliant item on the corresponding equipment to be inspected.

[0073] During the large-scale network device configuration verification process, this application may encounter situations where devices experience abnormal data collection. Example scenarios include:

[0074] (1) If a single device cannot log in, the system will set all indicators of the device to collection abnormal after waiting for a certain period of time to avoid delaying or terminating the progress of the entire collection task.

[0075] (2) If there are subtle differences between the data collection command echoed by a single device and the judgment rules, the system will use methods such as letter case conversion, automatic space cleanup, and regular expression matching logic to ensure the correctness of the verification conclusion.

[0076] Compared with the prior art, the automated configuration compliance verification method provided in this application provides a one-stop automated configuration compliance verification capability for network devices. Based on the construction of a multi-dimensional compliance rule base, it realizes automatic verification of the configuration compliance and security of network devices in scheduling data networks and integrated data networks, saving human resources for verification work and improving the accuracy of verification work.

[0077] Secondly, such as Figure 2 As shown in the illustration, this application also provides an automated configuration compliance verification device, including:

[0078] Data acquisition module 1 is used to log in to the device to be inspected using the SSH protocol to collect device configuration information;

[0079] Parsing module 2 is used to parse the equipment configuration information of the equipment to be inspected;

[0080] Select module 3 is used to select the corresponding inspection rule based on the parsed device configuration information;

[0081] Inspection module 4 is used to acquire inspection tasks and perform inspections on the equipment configuration information according to the inspection rules.

[0082] The distribution module 5 is used to distribute the selected inspection rules to the equipment to be inspected;

[0083] The acquisition module 6 is used to acquire the inspection report obtained by inspecting the equipment to be inspected according to the inspection rules.

[0084] Compared with the prior art, the beneficial effects of the automated configuration compliance verification device provided in this application are the same as those of the automated configuration compliance verification method provided in the first aspect, and will not be repeated here. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and not to limit them; although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. An automated configuration compliance verification method, characterized in that, include: Log in to the equipment to be inspected using the SSH protocol to collect equipment configuration information; The equipment configuration information of the equipment to be inspected is parsed; Select the corresponding inspection rule based on the parsed device configuration information; Obtain inspection tasks and inspect the equipment configuration information according to the inspection rules; The selected inspection rules will be sent to the equipment to be inspected. Obtain the inspection report obtained by inspecting the equipment to be inspected according to the inspection rules.

2. The automated configuration compliance verification method as described in claim 1, characterized in that, The method further includes: Establish a mapping relationship between the types of equipment to be inspected and the inspection rules.

3. The automated configuration compliance verification method as described in claim 1, characterized in that, The method further includes: Identify whether all the equipment to be inspected is of the same type; If so, select an inspection template that matches the type of the equipment to be inspected, the inspection template being assembled according to the inspection rules.

4. The automated configuration compliance verification method as described in claim 1, characterized in that, Before logging into the device to be inspected using the SSH protocol to collect device configuration information, the following steps are included: Determine if the equipment to be inspected is online; If not, the device to be inspected will be set to an abnormal state for collecting configuration information after a preset time period.

5. The automated configuration compliance verification method as described in claim 1, characterized in that, After obtaining the inspection report obtained from inspecting the equipment to be inspected according to the inspection rules, the process includes: Determine whether the content of the inspection report is standardized enough; If not, the non-standard content in the inspection report will be processed according to the preset processing method.

6. The automated configuration compliance verification method as described in claim 5, characterized in that, The preset processing methods include automatic removal of spaces by converting letter case and automatically cleaning up spaces.

7. The automated configuration compliance verification method as described in claim 1, characterized in that, After obtaining the inspection report obtained from inspecting the equipment to be inspected according to the inspection rules, the process includes: Determine whether there are any non-compliant items in the inspection report based on the verification standards; If so, highlight it and issue a reminder for the non-compliant item on the corresponding equipment to be inspected.

8. An automated configuration compliance verification device, characterized in that, include: The data acquisition module is used to log in to the equipment to be inspected using the SSH protocol to collect equipment configuration information; The parsing module is used to parse the equipment configuration information of the equipment to be inspected; The selection module is used to select the corresponding inspection rules based on the parsed device configuration information. The inspection module is used to acquire inspection tasks and inspect the equipment configuration information according to the inspection rules. The distribution module is used to distribute the selected inspection rules to the equipment to be inspected. The acquisition module is used to acquire the inspection report obtained by inspecting the equipment to be inspected according to the inspection rules.

Images