Management of the network using servers in the central computer system and server agents in local branch networks

Abstract

A process involves a local activation server agent of a first local branch network establishing an initial connection to an activation server of a central computer system. The activation server manages network device validation information corresponding to a variety of local branch networks, including the first local branch network. The process involves a local activation server agent communicating with the central activation server over the initial connection to receive network device validation information for a given network device connected to an entity connected to the first local branch network. In response to a given network device connecting to the first local branch network, the process involves establishing a second connection between that network device and the local activation server agent.The process involves the local activation server agent validating the given network device based on network device validation information for that device. This validation requires the local activation server agent to communicate with the given network device over the second connection.

Description

BACKGROUND

[0001] When a network device (e.g., a network switch) connects to a network for the first time, the network device undergoes an onboarding process to validate and configure it to communicate with the network. Zero Touch Provisioning (ZTP) is an automated onboarding process that requires no user assistance. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a block diagram of a computer network with a hybrid network management solution that includes cloud-based servers and local server agents according to an example implementation. Fig. Figure 2 is a sequence flow diagram illustrating the communication associated with starting a local activation server agent of a hybrid network management solution according to an example implementation. Fig. Figure 3 is a sequence flow diagram illustrating the communication associated with starting a local central server agent of a hybrid network management solution according to an example implementation. Fig. 4 is a sequence flow diagram illustrating communication onboard a network device using a local activation server agent and a local central server agent of a hybrid network management solution according to an example implementation. Fig. 5 is a sequence flow diagram showing communication between a local central server agent and a central server of a hybrid network management solution for managing network devices according to an example implementation. Fig. Figure 6 is a sequence flow diagram illustrating communication between components of a hybrid network management solution related to updating the firmware of a network device according to an example implementation. Fig. 7 is a flowchart illustrating a process for validating a network device using a central activation server and a local activation server agent according to an example implementation. Fig. Figure 8 is a block diagram of a system including a local activation server agent for validating a network device using information obtained from a central activation server according to an example implementation. Fig. 9 is an illustration of machine-readable instructions corresponding to a local activation server agent that, when executed by a machine, cause the machine to use information obtained from a central activation server to validate a network device, according to an example implementation. DETAILED DESCRIPTION

[0002] An enterprise may use a specific network management solution to manage its network devices. In this context, the term "management" of a network device refers to the regulation of all operational aspects of the network device. In one example, managing a network device may include onboarding the network device. In another example, managing a network device may include configuring the network device. In another example, managing a network device may include monitoring network telemetry metrics associated with or provided by the network device. In another example, managing a network device may include updating the network device's firmware.

[0003] A local network management solution may be suitable for a smaller computer network (e.g., a single local area network). As the name suggests, all components of a local network management solution can be located on the local network that contains the managed network devices. For example, the software components of a local network management solution can be hosted on one or more nodes (e.g., bare-metal servers) of a computer network that contains the managed network devices. A cloud-based network management solution may be more suitable for a relatively large computer network. For example, an organization may have multiple local branch networks connected to a wide area network (e.g., the Internet).As the name suggests, the software and hardware resources of a cloud-based network management solution can be located in the cloud, and as such, the resources can be located remotely with respect to the network devices managed by the solution. Compared to an on-premises network management solution, a cloud-based network management solution can be highly scalable, allowing the solution to be tailored to the number of network devices and the specific network infrastructure. Furthermore, a cloud-based network management solution provides an organization with the ability to manage network devices across multiple branch networks from a single dashboard.

[0004] In one example, a cloud-based network management solution may be offered as a subscription-based software-as-a-service (SaaS) provided by two main cloud-based components: a remote activation server and a remote central server. The remote activation server manages the licenses and subscriptions for the managed network devices, and the remote activation server validates the network devices when they are first connected to the network. The remote central server manages other operational aspects of the network devices, which may include pushing user-provided configuration data (e.g., configuration files) to the network devices and deploying firmware images for firmware upgrades to the network devices.The remote central server can also perform management services such as monitoring network telemetry data provided by the managed network devices, detecting failures and performance issues of network devices based on the network telemetry data, and monitoring remedial actions to resolve failures and / or performance issues of network devices.

[0005] A cloud-based network management solution may face certain challenges not encountered with an on-premises network management solution. For example, in a cloud-based network management solution, each managed network device may have a web socket connection to the central server, resulting in potentially hundreds to thousands of web socket connections (depending on the number of managed network devices) between the network devices and the remote central server. These numerous web socket connections can significantly contribute to the overhead of the remote central server. In another example, the large amount of network telemetry data from the network devices may be continuously processed for all managed network devices in the cloud, which can degrade performance (e.g., by causing delays in displaying the corresponding network telemetry data to users).Further problems can arise from the management abstraction introduced by the cloud-based network management solution. For example, this abstraction can reduce the visibility of troubleshooting for a system administrator. As a more specific example, when resolving a connectivity issue for a network device, this abstraction can make it difficult to determine whether the connectivity issue is due to a connection problem (e.g., the network device has the wrong IP address for the remote central server), a validation error (e.g., the network device does not have the correct login credentials or has not been registered with the subscription account), or another reason.In addition, due to the abstraction, a system administrator may not be able to determine whether the connection problem corresponds to a problem related to the remote activation server or a problem related to the remote central server.

[0006] According to the example implementations described here, a hybrid network management solution comprises local network management components and remote, centralized (e.g., cloud-based) network management components. The hybrid network management solution significantly reduces the number of network connections to the managed network devices compared to a centralized network management solution. Due to the local collection and caching of network telemetry data, the hybrid network management solution reduces the volume of network telemetry data transmitted to the remote central server and accordingly improves the performance (e.g., reduces overhead time) of telemetry monitoring. Furthermore, unlike a centralized network management solution, the hybrid network management solution provides a local network overview to improve troubleshooting.In addition, unlike an on-premises network management solution, the hybrid network management solution has cloud-based resources that can be scaled according to the number of network devices managed and / or the corresponding network infrastructure, and a system administrator can use a single dashboard to manage a group of network devices distributed across multiple local branch networks.

[0007] According to example implementations, remote centralized components of a hybrid network management solution include a remote activation server (e.g., a cloud-based activation server) and a remote centralized server (e.g., a cloud-based centralized server). The managed network devices may be contained within one or more local branch networks. Each local branch network, according to example implementations, contains local agents that correspond and communicate with remote centralized components. Specifically, according to example implementations, each local branch network contains a local activation server agent that corresponds and communicates with the remote activation server, and each branch network contains a local centralized server agent that corresponds and communicates with the remote centralized server.For high availability (HA), each branch network can contain multiple local activation server agents (which correspond and communicate with the remote activation server) and multiple local central server agents (which correspond and communicate with the remote central server) hosted by multiple local compute nodes.

[0008] According to example implementations, the local agents start and establish secure connections with their respective remote, cloud-based counterparts before network devices connect to the local branch network for the first time. As part of this start-up process, the local activation server agent retrieves subscription and license information for a set of potential network devices that can be connected to the local branch network. In one example, this set of potential network devices might include network devices whose identifiers have been registered with the corresponding subscription but are not yet included in any of the branch networks associated with the subscription.

[0009] According to sample implementations, when a network device first connects to the local branch network, the network device obtains connection details (such as an Internet Protocol (IP) address) for the local Activate Server agent from a local Dynamic Host Control Protocol (DHCP) server. Using this connection information, the network device contacts the local Activation Server agent and requests a connection. The local Activation Server agent can then validate the network device. Upon successful validation, the local Activation Server agent provides the network device with the connection information (such as an IP address and a digital certificate) for the local central server agent.

[0010] The local central server agent, according to example implementations, serves as a message broker between the managed network devices and the remote central server, among its other functions. In some implementations, the local central server agent has a single secure connection to the central server. The managed network devices send management-related messages (for example, messages with network telemetry content) to the local central server agent, and the local central server agent consolidates or groups the messages into a set of one or more messages, which are sent from the local central server agent to the central server over the agent's single secure connection to the remote central server. In addition, according to example implementations, the local central server agent demultiplexes or separates consolidated management-related messages (for example,Messages (e.g., messages containing configuration files) received from the remote central server are converted into messages that are forwarded to the respective managed network devices. By multiplexing and demultiplexing messages by the central server agent, the number of network connections between the local central agent and the remote central server is minimized and is independent of the number of managed network devices.

[0011] Among other features, the local central server agent may maintain a local database that is synchronized with a central database managed by the remote central server. In one example, the local database may store information such as data representing the inventory of the managed network devices and data representing the last known good configurations for the managed network devices. Furthermore, in accordance with some implementations, the local central server agent may preemptively retrieve newer versions of firmware images for the managed network devices as the newer firmware images become available. The local central server agent may store the retrieved firmware images in a local firmware repository managed by the local central server agent.Preemptively downloading firmware images to a local repository accelerates future firmware upgrades for managed network devices.

[0012] Referring to Fig. 1, as a more specific example, a hybrid network management solution implemented in a computer network 100 manages network devices 114 that may be included in one or more local branch networks 110 (N branch networks 110-1 to 110-N are shown in Fig. 1 of the computer network 100). The hybrid network management solution comprises remote central components of a central computer system and local components of the local branch networks 110. In the Fig. 1, the central computer system is a remote, cloud-based central cloud system 180 that includes remote cloud-based components of the hybrid network management solution.

[0013] As used here, "remote" and "local" are relative terms that indicate whether facilities or services are located on the same or different networks. In one example, a local area network might be a private network. In one example, a remote network might be a private network in the cloud. As used here, a "local branch network" is a network associated with a specific geographic location that communicates with one or more other networks through a fabric of networks. A local branch network may also be referred to as a "local branch computer network" or "local network." In one example, a local branch network might be a local area network (LAN). In examples, a local branch network might be a network that corresponds to a specific building, group of buildings, or campus. In one example, a local branch network might correspond to an edge computing system.In another example, a local branch network may correspond to a system of Internet of Things (IoT) devices (e.g., sensors, controllers, cameras, or other devices). In another example, a local branch network may correspond to an edge system.

[0014] In this context, a "central computer system" refers to a computer system that coordinates the activities associated with multiple local branch networks. The central computer system may be decentralized, meaning that the components of the central computer system are not located on the same local branch network 110 as the managed network devices 114. In one example, a central computer system and the local branch networks may be part of a WAN. In one example, a central computer system may be a distributed system of hardware and software that communicates with the local branch networks over a WAN connection. For example, a central computer system may be a cloud-based system of software and hardware that may be distributed across one or more computer racks, one or more data centers, and one or more availability zones.In one example, a central computer system may provide a cloud-based service, such as a SaaS.

[0015] In this context, a "cloud-based" entity, such as a cloud-based server, refers to a unit of a distributed system of hardware and software accessed over a wide area network (WAN), such as the Internet. In one example, a cloud-based server may be virtual (e.g., it may correspond to one or more virtual machines) and hosted on one or more computing platforms (e.g., blade servers or rack servers). In examples, a cloud-based entity may be part of a public cloud, a private cloud, or a hybrid cloud.

[0016] The implementations described below assume that the core components of the hybrid network management solution are remote, cloud-based components located in a remote central cloud system. However, it should be noted that, in accordance with further implementations, the core components of a hybrid network management solution may be located in a remote central computer system (e.g., a private computer system of an enterprise) that is not a cloud-based computer system.

[0017] Although in Fig. 1 illustrates specific local components of the hybrid management solution for the example branch network 110-1, other branch networks 110 may have similar local components. The local branch networks 110 may have many different architectures or shapes depending on the particular implementation. Furthermore, the local branch networks 110 may be the same network type or may be connected to different network types (e.g., the branch networks 110 may include a mix of campus, data center, and IoT networks). According to some implementations, a particular local branch network 110 may be associated with a subscription to a network management service (provided by the hybrid network management solution) and with a particular subscription account holder.Moreover, according to some implementations, multiple branch networks 110 may be associated with the same subscription and, accordingly, with the same subscription account holder.

[0018] The cloud-based components of the hybrid network management solution include a remote activation server 184 and a remote central server 188. The remote activation server 184 manages data representing subscriptions to the hybrid network management solution and license information for network devices. In one example, the subscriptions may be associated with corresponding user accounts, and each subscription may provide a license for up to a predetermined number of registered network devices 114. In one example, a user (e.g., a system administrator) may register specific network devices 114 (e.g., via Media Access Control (MAC) addresses or other network device identifiers) for a particular subscription.

[0019] In accordance with some implementations, the remote activation server 184 may generate data to control a user interface through which a system administrator associated with a particular subscription account holder may view and update subscription and license information. In one example, the user interface may be a web-based graphical user interface (GUI) accessible by the system administrator through an Internet browser hosted on an administrative node 198.

[0020] The remote central server 188 may perform a variety of management services for the managed network devices 114, in accordance with example implementations. In one example, the remote central server 188 may provide configuration data (e.g., configuration files) in connection with the onboarding of network devices. In another example, the remote central server 188 may monitor network telemetry data. In another example, the remote central server 188 may identify potential or actual problems with network devices. In another example, the remote central server 188 may detect potential or actual problems with network performance. In another example, the remote central server 188 may oversee remedial actions to resolve network problems. In another example, the remote central server 188 may provide firmware images.For this purpose, the remote central server 188 hosts a monitoring application 190 and a central application 192.

[0021] The monitoring application 190 receives and processes, in accordance with example implementations, network telemetry data (e.g., messages) provided by the network devices 114. In this context, the term "network telemetry data" generally refers to information or content that represents information from which insight into the state of a network, a network device, or a network device (or devices) connected to a client device can be obtained, directly or indirectly. Network telemetry data can either be specifically requested (or "pulled") from a network device 114 (e.g., in response to a request from the monitoring application 190) or delivered (or "pushed") from a network device 114 to the monitoring application 190 without being specifically requested.

[0022] In one example, the network telemetry data may include a periodically measured statistic of a network or network device metric or measurement. In one example, a statistic may be a traffic flow volume (e.g., a traffic flow volume for a particular VLAN) for a particular sample period. In other examples, a statistic may be a periodically measured egress bandwidth, an ingress bandwidth, a latency, a round-trip time, or a utilization of a resource or activity of a host. In other examples, network telemetry data may represent a value of a counter of a network device, a configuration setting of a network device, an event log of a network device, a status snapshot of a network device, a configuration snapshot of a network device, or other information about a network device. Network telemetry data may represent events.In one example, a network device can send network telemetry messages triggered by certain change events (e.g., a network telemetry message triggered by the network device sending a disconnect message). In general, network telemetry data can represent information about the control, management, and / or data planes of a network.

[0023] Processing of network telemetry data by monitoring application 190 may take various forms. In one example, monitoring application 190 may generate data based on network telemetry data to graphically display network telemetry metrics, network traces, statistics, or other network-related information on a user interface. In another example, monitoring application 190 may log network telemetry data and / or network telemetry events. In another example, monitoring application 190 may process network telemetry data to identify network problems. In one example, monitoring application 190 may predict a failure or inadequate performance of a network device 114, another network component (e.g., a server), or a network subnetwork based on network telemetry data.In another example, monitoring application 190 may identify an actual failure or inadequate performance of a network device 114, another network component, or a network subnet based on network telemetry data. In another example, monitoring application 190 may identify a suboptimal configuration for a network device based on network telemetry data. In accordance with some implementations, the monitoring application's identification and / or prediction of network problems may be assisted, in whole or in part, by one or more machine learning models. In one example, a particular machine learning model may be a supervised or unsupervised model.In accordance with some implementations, the monitoring application's identification of network problems may be supported, in whole or in part, by one or more knowledge bases that associate problems with observed network telemetry metrics.

[0024] In accordance with some implementations, the monitoring application 190 may provide a recommended solution to an identified network problem. In one example, a recommendation may be a suggested reconfiguration of one or more network devices 114. In another example, a recommendation may be a suggested reconfiguration of a particular network subnet. In another example, a recommendation may be a suggested replacement or upgrade of one or more network devices 114. In another example, a recommendation may be a suggested firmware upgrade for a particular network device 114 or group of network devices 114. According to some implementations, the monitoring application's recommendations may be supported in whole or in part by one or more machine learning models (e.g., supervised or unsupervised models).In accordance with some implementations, the monitoring application's recommendations may be supported in whole or in part by one or more knowledge bases that link recommendations to specific network problems.

[0025] In accordance with some implementations, the monitoring application 190 may generate data to drive a user interface (e.g., a web-based GUI displayed via an Internet browser), such as a dashboard displayed on an administrative node 198. For example, through this dashboard, a system administrator may view the network performance and network issues of all branch networks 110 associated with a particular user account.

[0026] The central application 192, in accordance with example implementations, may generate data to drive a user interface (e.g., a web-based GUI displayed via an Internet browser) through which a system administrator (via a management node 198) associated with a particular account holder may take action to initiate various management-related actions. In one example, an administrator may upload one or more configuration files to be installed on a particular network device as part of onboarding the network device 114. In another example, an administrator may initiate a reconfiguration of a network device 114. In another example, an administrator may approve a solution recommended by the monitoring application 190 to address a particular network problem.In another example, an administrator can initiate a firmware upgrade for a specific network device.

[0027] In accordance with example implementations, the hybrid network management solution includes local components located in the branch networks 110. As in Fig. 1, these local components for the branch network 110-1 include a local activation server agent 118 and a local central server agent 130. In accordance with example implementations, the local activation server agent 118 retrieves user account subscription information 120 from the remote activation server 184 via a single secure connection 119 to the remote activation server 184. The user account subscription information 120 is relevant to licensed network devices 114 that are or may be incorporated into the branch network 110-1.As further described herein, the local activation server agent 118 is detected by newly connected network devices 114, validates the network devices 114 based on the user account subscription information 120 and possibly other criteria, and, for successfully validated network devices 114, provides the network devices 114 with connection details for the local central server agent 130.

[0028] The local central server agent 130, among its other functions (which are further described herein), manages the exchange of messages between the network devices 114 and the central server 188 in a manner that facilitates the use of a single, secure network connection (in Fig. 1 by the dashed line 131) with the central server 188. The single network connection 131 advantageously reduces the overhead of the central server 188 (as opposed to, for example, a network connection for each network device 114).

[0029] According to the example implementations, the central cloud system 180 is connected to the network fabric 164, and each local branch network 110 may be connected to the network fabric 164 via a corresponding gateway 160. The network fabric 164 may be connected to one or more types of communications networks, such as (as examples) Fibre Channel networks, Compute Express Link (CXL) fabrics, dedicated management networks, local area networks (LANs), WANs, global networks (e.g., the Internet), wireless networks, or any combination thereof.

[0030] At the Fig. 1, the branch network 110-1 includes a pool 112 (or “managed network device pool 112”) of network devices 114 (in Fig. Figure 1 shows M network devices (114-1 to 114-M) that have been integrated into the branch network 110-1 and are managed by the hybrid network management solution. The network devices 114 may alternatively be referred to herein as "managed network devices" because the network devices 114 are managed by the hybrid network management solution.

[0031] As used herein, a "network device" refers to an actual or physical electronic component that enables data communication between other components. For example, a network device might be a switch, which operates at layer two (L2) of the Open Systems Interconnection (OSI) model to interconnect components of a computer network. In another example, a network device might be a layer three (L3) switch, which connects the two components of a computer network and interconnects computer networks. In other examples, a network device might be a gateway, a multicast router, a bridge, a component of a Gen-Z or Compute Express Link (CXL) network, a processor device, a network interface controller (NIC), or a fabric switch, which includes one or more of the foregoing devices.A network device can be a wired or wireless device.

[0032] The number of network devices 114 included in the branch network 110-1 may be less than the number of network devices registered for the particular subscription that the branch network 110-1 covers. In one example, this discrepancy may be due, at least in part, to other network devices registered for the subscription being included in one or more other branch networks 110. In another example, the discrepancy may be due, at least in part, to other network devices registered for the subscription but not yet included.

[0033] In accordance with example implementations, when a network device 114 is first connected to the branch network 110-1, it participates in an onboarding process. In this context, an "onboarding process" refers to a sequence of events that, if successful, configures the network device 114 to communicate with other devices of the branch network 110. Furthermore, successful onboarding of the network device 114 may enable the network device 114 to communicate with devices outside the branch network 110.

[0034] Consistent with example implementations, the onboarding process may be a ZTP process (or "ZTP onboarding process" or "ZTP onboarding"). The following examples discuss ZTP onboarding for network device 114-2, with the understanding that other network devices 114 may be onboarded in a similar manner. In one example, ZTP onboarding for network device 114-2 may be initiated or triggered when network device 114-2 is fully powered and connected via a network cable to a component (e.g., a network switch, a top-of-the-rack (ToR) switch, a chassis controller, or gateway 160) connected to branch network 110-1. In another example, the network device 114-2 may be a wireless device that is wirelessly connected to the branch network 110-1 to initiate onboarding of the network device 114-2.

[0035] In one example of ZTP onboarding, network device 114-2 may be a DHCP client. When network device 114-2 first connects to branch network 110-1 and sends a DHCP discovery request, a DHCP server 104 of branch network 110-1 responds to the DHCP discovery request with a message including an IP address for network device 114-2 and one or more DHCP options. According to example implementations, DHCP server 104 may provide a DHCP option that identifies connection information for a local activation server agent 118. In one example, the connection information may be an IP address of local activation server agent 118.In one example, the connection information may be a digital certificate corresponding to the local activation server agent 118 and that may be used by the network device 114-2 for purposes such as providing a credential that allows the local activation server agent 118 to authenticate the network device 114-2.

[0036] The DHCP server 104 may provide one or more DHCP options, other than connection information, to the local activation server agent 118. In one example, a DHCP option may be an IP address of the gateway 160. In another example, a DHCP option may be an IP address of a Domain Name Service (DNS) server. In another example, a DHCP option may be an IP address of a Network Time Protocol (NTP) server. In another example, a DHCP option may be an identification of a minimum firmware image version for the network device 114-2, and another DHCP option may be an IP address of a Trivial File Transfer Protocol (TFTP) server from which the network device 114-2 can retrieve a firmware image that conforms to the minimum firmware image if it is non-compliant. In another example, a DCHP option can identify a configuration file from which settings (for example,NTP settings, SNMP settings, DNS settings, sflow settings, or other settings) for the network device can be obtained, and an IP address of a server that provides the configuration file can be found.

[0037] The network device 114-2 uses the connection information provided by the DHCP server 104 to send a connection request to the local activation server agent 118. As part of the ZTP introduction process, the network device 114-2, in accordance with example implementations, makes a connection request to the local activation server agent 118. In response to the connection request, the local activation server agent 118 validates the network device 114-2. In this validation, the local activation server agent 118 may consider any number of different criteria. In one example, one criterion may be whether the network device 114-2 possesses a pre-shared key that corresponds to a pre-shared key possessed by the local activation server agent 118. For example, one criterion may be whether the network device 114-2 possesses a particular digital certificate.For example, one criterion may be whether an identifier (e.g., a MAC address) of the network device 114-2 is on the list of MAC addresses associated with a subscription corresponding to the local network branch 110. In this way, the agent 118 of the local activation server may match an identifier (e.g., a MAC address) of the network device 114-2 with the subscription information 120 of the user account. In one example, one criterion may be whether a device type of the network device 114 is compatible with an architecture or configuration of the local branch network 110. In one example, one criterion may be whether a version or model of the network device 114-2 is compatible with a configuration or architecture of the local branch network 110 (e.g., checking whether the network device 114-2 conforms to a minimum version that supports certain features).

[0038] In response to the successful validation of the network device 114-2 by the local activation server agent 118, a connection 115 may then be established between the local activation server agent 118 and the network device 114-2. Using the connection 115, the local activation server agent 118 may then send data representing connection details for the local central server agent 130 to the network device 114-2. In one example, the connection details may include an IP address of the local server agent and a digital certificate.

[0039] In response to receiving the connection details for the local central server agent 130, the network device 114-2 may then send a connection request to the local central server agent 130. After successful validation of the network device 114-2 by the local central server agent, a secure connection 129 may then be established between the local central server agent 130 and the network device 114-2.

[0040] In accordance with some implementations, the local central server agent 130 includes a message broker 135 that provides a streamlined message queuing service for handling message traffic between the network devices 114 and the remote central server 188. In this context, a "message broker" generally refers to an entity that enables different entities (e.g., instances, services, and systems) to communicate with each other. In general, a message broker may perform message validation, format conversion, and forwarding of messages between different entities. The message broker 135 may use a number of different messaging protocol standards, such as Kafka, Message Queuing Telemetry Transport (MQTT), Apache, RabbitMQ, or other messaging protocol standards.

[0041] As in Fig. 1, in accordance with some implementations, the message broker 135 may include a plurality of transmit queues 138 and a plurality of receive queues 136. In one example, the receive queues 136 may be associated with the respective network devices 114 and temporarily store transient data representing messages received from the remote central server 188. In one example, the transmit queues 138 may be associated with the respective network devices 114 and temporarily store transient data representing messages sent from the respective network devices 114 to the remote central server 188.

[0042] According to embodiments, the local central server agent 130 collects in the send queues 138 the messages sent from the network devices 114 to the central server 188. When triggered, the local central server agent 130 consolidates the messages from all send queues 138 (thus emptying the send queues 138) and sends over a secure connection (in Fig. 1 by the dashed line path 131) sends one or more messages containing the content of the messages sent by the network devices 114 to the central server 188. In one example, the triggers for consolidating and sending the data may correspond to the times of a predefined schedule. In another example, a trigger may be a full or near-full status (e.g., a certain percentage or queue full) of one of the transmit queues 138. In another example, a trigger may be generated in response to metrics indicating a full status of the transmit queues. In another example, a trigger may be based on a maximum wait time for data in a transmit queue 138.The message broker 135 may trigger the sending of messages to the central server 188 based on one or more other criteria, according to further implementations.

[0043] In accordance with example implementations, the remote central server 188 sends messages for all network devices 114 of the branch network 110-1 over the single secure connection 131 to the local central server agent 130. The message broker 135 sorts the messages received from the remote central server 188 by placing them in the appropriate receive queues 136 before forwarding them to the appropriate network devices 114.

[0044] As in Fig. 1, in accordance with example implementations, a cache 132 may be located between the local central server agent 130 and the gateway device 160. The cache 132 promotes fast data retrieval and synchronization. In one example, the cache 132 may be an in-memory data store, such as a Redis in-memory data store or another data store.

[0045] In accordance with some implementations, the local central server agent 130 may maintain a local database 140 that mirrors a database (not shown) maintained by the remote central server 188. In one example, the local database 140 may store data representing the last known good state for each of the network devices 114. In another example, the local database 140 may store data representing the last configuration status of each of the network devices 114. In another example, the local database 140 may store data representing the most recent telemetry data provided by each of the network devices 114. In another example, the local database 140 may store data representing a solution or diagnostic for a network device 114 provided by the central application 192.The local central server agent 130 and the remote central server 188 can exchange messages over the secure connection 131 to communicate changes to the database of both sides and to ensure that the data stored in both databases is consistent.

[0046] As also in Fig. 1, the local central server agent 130 may, in accordance with example implementations, maintain and use a firmware repository 142. The firmware repository 142 generally stores firmware images that may be used to update the firmware of network devices 114.

[0047] In accordance with some implementations, the local central server agent 130 may preemptively download firmware images from the remote central server 188. In this context, the "preemptive download" of a firmware image by the local central server agent 130 refers to the local central server agent 130 retrieving the firmware image from the remote central server 188 without first being prompted to perform a corresponding firmware upgrade on a particular network device 114 using the firmware image.

[0048] In one example, the preemptive downloading of firmware images for a particular network device 114 or set of network devices 114 may be controlled by a particular policy. In one example, a policy may specify that the local central server agent 130 retrieves, when available, firmware images corresponding to newer firmware versions than the firmware currently installed on the network devices 114 and stores the retrieved firmware images in the firmware repository 142. In one example, a policy may allow a certain number of newer version firmware images to be retained in the firmware repository 142 so that when the firmware for a particular network device 114 is to be updated, multiple firmware upgrade options are available (e.g., a selection made by a system administrator). In one example, a particular firmware image may apply to multiple network devices 114.Preemptive downloading of a firmware image accelerates its retrieval when the firmware of a network device 114 needs to be updated; moreover, firmware validation and updating can be performed more smoothly and quickly due to the local availability of the firmware image.

[0049] Among other features, according to some implementations, the local central server agent 130 may provide a remote troubleshooting user interface that enables a system administrator to diagnose and manage problems with the local components of the hybrid network management solution. In one example, the local central server agent 130 may provide a virtual private network (VPN) server connection that enables a VPN client (e.g., a VPN client of a management node 198) to access the branch network 110-1 for troubleshooting purposes. Additionally, according to example implementations, the local activation server agent 118 may provide a remote troubleshooting user interface (e.g., a VPN server interface) that enables a system administrator to resolve problems associated with the local activation server agent 118.

[0050] In accordance with some implementations, the activation server 184 and the central server 188 may correspond to machine-readable instructions (or "software") executing on one or more nodes of the central cloud system 180. As used herein, a "node" refers to a processor-based entity that has an associated set of hardware and software resources. In one example, a "node" may be a computing platform. In this context, a "computing platform" is a processor-based electronic device that has an associated operating system. A computing platform may be, for example, a rack server or a blade server. In another example, a "node" may be virtualized.For example, in accordance with some implementations, a node may comprise an abstraction of hardware and software resources of a physical computing platform, such as a virtual machine.

[0051] In accordance with some implementations, the remote central cloud system 180 may include multiple remote activation servers 184 and multiple remote central servers 188. In one example, different pairs of a remote activation server 184 and a remote central server 188 may form corresponding network management clusters. Thus, according to some implementations, a network management cluster for a group of branch networks 110 may include a remote activation server 184, a remote central server 188, local central server agents 130 located in the group of branch networks 110, local active server agents 118 located in the group of branch networks 110, and the network devices 114 located in the group of branch networks 110.

[0052] In accordance with example implementations, for the purpose of high availability (HA), multiple local central server agents 130 and multiple local activation server agents 118 may be located in the same branch network 110. As in Fig. 1, the branch network 110-1 includes a plurality of local central server agents 130. In one example, the tasks of the local central server agents may be distributed among a plurality of local central server agents 130 of an HA group. In one example, each local central server agent may be assigned to a particular group of network devices 114 and perform central server agent tasks for the network devices 114 of the assigned group. Should a particular local central server agent 130 of the HA group fail, the tasks of the failed local central server agent 130 may be transferred to the remaining active local server agents 130 of the HA group. Similarly, in accordance with some implementations, the branch network 110-1 may include a plurality of local server agents 118 forming an HA group for the purpose of providing HA.In one example, the tasks of the activation server agents can be distributed among the local activation server agents 118 of the HA group. In one example, each local activation server agent 118 can be assigned to a specific group of network devices 114 and assume responsibility for validating the network devices 114 of the assigned group. If a specific local activation server agent 118 of the HA group fails, the tasks of the failed local activation server agent 118 can be transferred to the remaining active local activation server agents 118 of the HA group.

[0053] In accordance with example implementations, the local components of the hybrid network management solution may be hosted by nodes of the branch network 110. As in Fig. 1, for the branch network 110-1, a particular local central server agent 130 may be associated with a set of machine-readable instructions (or "software") that execute on one or more nodes 147 of the branch network 110-1. Furthermore, in accordance with example implementations, a particular local activation server agent 118 may include a set of machine-readable instructions that execute on one or more nodes 147 of the branch network 110-1.

[0054] A particular node 147 may be physical or virtual. Regardless of its particular form, node 147 may be connected to one or more hardware processors 148 and memory 149. Hardware processor 148 is a physical or actual processor that executes machine-readable instructions (e.g., software or firmware instructions). In examples, processor 148 may include one or more central processing unit (CPU) cores or one or more graphics processing unit (GPU) cores. Memory 149 is a non-transitory storage medium that may be formed from semiconductor memory devices, memristor-based memory devices, magnetic memory devices, phase-change memory devices, a combination of devices of one or more of these memory technologies, etc. Memory 149 may represent a collection of memories including both volatile and non-volatile memory devices.According to some implementations, one or more nodes 147 may be hosted on a particular physical computing platform, such as a bare metal server, a server blade, a rack server, or other computing platform of the branch network 110-1.

[0055] According to example implementations, the local components of the hybrid network management solution are first installed and started before network devices 114 are connected to or integrated into the branch network 110-1. According to example implementations, the first local component to be started is the local activation server agent 118. Fig. 2 shows a sequence flow diagram 200 illustrating communication associated with starting a local activation server agent in accordance with example implementations.

[0056] As in Fig. 2, in response to the start of the local activation server agent 118, the local activation server agent 118 sends a connection request to the remote activation server 184 (see Fig. ). In response to the connection request 204, the remote activation server 184 sends a credential request to the local activation server agent 118 (see Fig. ). In one example, credential request 208 may request local activation server agent 118 to provide information (e.g., a digital certificate) used to authenticate that local server agent 118 is connected to remote activation server 184 and is connected to a particular branch network. As illustrated at 212, local activation server agent 118 may then respond with the credentials, and in response to remote activation server 184's validation of the credentials, an authenticated and secure connection may then be established between local activation server agent 118 and remote activation server 184, as illustrated at 216.

[0057] Over the secure connection 216, the remote activation server 184 may then provide the local activation server agent 118 with user account subscription information, as illustrated at 220. In one example, the remote activation server 184 may examine a subscription corresponding to the particular branch network containing the local activation server agent 118 to identify network devices associated with the subscription that have yet to be powered on, and provide the local activation server agent 118 (as part of the user account subscription information 220) with data representing those network devices. In one example, the information 220 may include information representing identifiers (e.g., MAC addresses) for the network devices.

[0058] In accordance with example implementations, the local activation server agent 118 may then open a user interface that can be used by a management node device 198 to troubleshoot problems locally. In this way, a system administrator may communicate with the local activation server agent 118 via a management node 198 to establish a secure connection 230 (as shown at 224 and 228) to the user interface.

[0059] In accordance with example implementations, a local central server agent 118 may be started after the local active server agent is started. Fig. 3 shows a sequence flow diagram 300 illustrating communication associated with starting a local active server agent 118. In one example, a local activation server agent 118 may monitor a particular network port for discovery messages from a local central server agent 130, indicating that the local central server agent 130 is in the startup process.

[0060] As in Fig. 3, according to flowchart 300, the local central server agent 130 first provides a connection / discovery request, as shown at 304. The local activation server agent 118 may then observe the connection request 304 (e.g., observe the request 304 on a particular network port) and, in response to the request 304, provide a credential request, as shown at 308. As shown in Fig. 3, the local central server agent 130 provides a response to the credential request that includes the credentials, as shown at 312. The local central server agent 130 and the local activation server agent 118 may then, as shown in the Fig. shown, establish a secure connection 319 between agents 118 and 130.

[0061] The agent of the local activation server 118 can then send connection information for a central server 318 over the secure connection 319, as shown in 320. The agent of the local central server 130 can then transmit a connection request with the login information to the remote central server 188 (see Fig. ). The remote central server 188 and the local central server agent 130 may then establish a secure connection 330 between the remote central server 188 and the local central server agent 130, as illustrated in 326 and 328. Over this single secure connection 330, the remote central server 188 and the local central server agent 130 may communicate messages between the remote central server 188 and a number of managed network devices, in accordance with example implementations.

[0062] Fig. 4 shows a sequence flow diagram 400 illustrating the onboarding of a network device 114 in accordance with example implementations. In accordance with example implementations, the onboarding process may be a ZTP onboarding process. As shown in Fig. 4, onboarding may, for example, be preceded by the uploading of configuration data (e.g., a firmware image, a configuration file, or other configuration information) by a management node 198 to the central application 192 (see Fig. ). The upload of configuration data may occur during or after the onboarding of the network device 114, depending on the particular implementation. Furthermore, according to example implementations, the local central server agent 130 may update a local database 140 with information about the network device 114 before the onboarding begins (see Fig. ). In another example, the database update 402 may occur during the onboarding process.

[0063] The onboarding of the network device 114 occurs when the network device 114 issues a DHCP broadcast request, which is received by a DHCP server 104 (see Fig. ). In response to the DHCP broadcast request, the DHCP server 104 provides a DHCP offer with connection information to the local activation server agent 130 (see Fig. ). In response to the DHCP offer, the network device 114 may then contact the local activation server agent 412, as illustrated at 412, to obtain connection information for the local central server agent, as illustrated at 416.

[0064] In response to contact by the network device 114, the local activation server 114 may validate the network device, as illustrated at 414. In one example, validation may include the local activation server agent 118 determining whether the network device 114 is registered with the appropriate subscription. In another example, validation may include the local activation server agent 118 determining whether the network device 114 has a valid digital certificate or possesses one or more other credentials. In another example, validation by the local activation server agent 118 may include the local activation server agent 118 determining whether the network device 114 is compatible with the local branch network or conforms to a device type associated with a minimum local branch network criterion.In response to the local activation server agent 118 successfully validating the network device 114, the local activation server agent 118 may then provide the network device 114 with connection information for the local central server agent 130, as illustrated at 416.

[0065] In response to receiving the connection information for the local central server agent 130, the network device 114 may then transmit an onboarding request to the local central server agent 130, as illustrated at 420. Furthermore, the network device 114, the local central server agent 130, and the central application 192 may, as shown in the Fig. , perform a synchronization of the onboarding data. Once data synchronization is established, the central application 192 may provide configuration data to the local central agent 130. The local central server agent 130 may then read the configuration data from the corresponding received queue, as shown at 442, and provide the configuration data to the network device 114, as shown at 446.

[0066] In one example, the configuration data may correspond to one or more configuration files (e.g., YAML files). In one example, the configuration data may configure any number of different settings of the network device 114, such as Quality of Service (QoS) settings, Class of Service (CoS) settings, Virtual Local Area Network (VLAN) tagging settings, VLAN untagging settings, ingress bandwidth settings, egress bandwidth settings, Power over Ethernet (POE) settings, and various and / or other configurable settings for the network device 114. In another example, the configuration data may include a firmware image for the network device 114.

[0067] As illustrated at 450, the network device 114 may provide a configuration data synchronization confirmation by writing the configuration data synchronization confirmation information to the appropriate transmission queue (see 450 and 454). Accordingly, the local central server agent 130 may then transmit a configuration data synchronization confirmation to the central application 192 (see Fig. ).

[0068] Fig. 5 shows a sequence flow diagram 500 illustrating communication between a local central server agent 130 and a remote central server 188 for the purpose of monitoring network devices and monitoring the implementation of remedial actions to resolve problems associated with the network devices. In one example, the remote central server 188 may include a monitoring application and a central application for these purposes, as described herein.

[0069] As in Fig. 5, the network devices 114 may provide network telemetry messages 504 that are received by the local central server agent 130 (see Fig. ). Data corresponding to the network telemetry messages is written to corresponding transmit queues of the local central server agent 130, as shown in 508, and the local central server agent 130 consolidates the messages from the transmit queues, as shown in 512.

[0070] The agent of the local central server 130 may then send one or more consolidated network telemetry messages to the remote central server 188, as illustrated at 516. The remote central server 188 may then sort the telemetry messages from the consolidated message(s) according to the network device, and the remote central server 188 may then analyze the network telemetry data, as illustrated at 520. Furthermore, for any identified problems that can be resolved by the remote central server 188, as illustrated at 524, the remote central server 188 may generate data in response to the analyses and send corresponding messages to the local central server agent, as illustrated at 524 and 528.

[0071] The local central server agent 130 can then sort the consolidated telemetry analysis response messages into the appropriate receive queues (see Fig. ). From these receive queues, the local central server agent 130 can then send telemetry analysis messages to the appropriate network devices 114, as shown in 536.

[0072] A local central server agent can retrieve newer versions of firmware images for the network devices it manages in advance, so that the newer versions of firmware images are available locally when corresponding firmware upgrades of the network devices are initiated. Fig. 6, a flowchart 600 is shown illustrating communication associated with performing a firmware upgrade on a network device 114 in accordance with example implementations.

[0073] As in Fig. 6, a local central server agent 130 may communicate with a remote central server 188 to retrieve firmware images from the remote central server 188 (see Fig. ). The local central server agent 130 may store the retrieved firmware images in a local firmware repository 142, as shown in 608.

[0074] Fig. 6 shows a firmware upgrade request 612 submitted by a management node 198 to designate a specific network device 114 for a firmware upgrade. In this example, the firmware upgrade refers to a firmware image previously retrieved by the local central server agent 130 and stored in the local firmware repository 142. For example, the firmware upgrade request 612 may be made by an administrator selecting a firmware upgrade option and selecting the specific network device 114 from a dashboard (e.g., a dashboard provided by a central server).

[0075] When performing the firmware upgrade, the local central server agent 130 can read the corresponding firmware image from the firmware repository 142 and validate the firmware image, as described in the Fig. In response to the validation of the firmware image, the local central server agent 130 may then communicate with the network device 114 to deploy the firmware image to the network device 114 and manage the firmware upgrade (see Fig. ).

[0076] According to Fig. 7, in accordance with example implementations, a process 700 includes establishing (block 704) a first connection with an activation server of a central computer system by a local activation server agent of a first local branch computer network. In one example, the central activation server may be a cloud-based server. The activation server maintains network device validation information corresponding to a plurality of local branch networks, including the first local branch network. In one example, the activation server may be a cloud-based server. In examples, the local branch network may be an edge network, a campus network, an IoT network, or a data center network.

[0077] According to block 708, process 700 includes communication by a local activation server agent with the activation server over the first connection to receive network device validation information for a particular network device associated with an entity connected to the first local branch network. In one example, the given network device may be a network switch. In one example, the communication may occur prior to the first connection of the given network device to the first local branch network. In one example, the network device validation information may include an identifier corresponding to the given network device. In one example, the network device validation information may associate the identifier with a subscription. In one example, the local activation server agent may be one of an HA group of local activation server agents.

[0078] According to block 712, in response to the given network device connecting to the first local branch network, the process includes establishing a second connection between the given network device and the local activation server agent. In one example, the second connection may be established in response to the given network device receiving connection details for the local activation server agent from a DCHP server and providing the connection details to the local activation server agent. In accordance with example implementations, the connection details may be provided as one or more DCHP options. In one example, the connection details may include an IP address of the local activation server agent.

[0079] According to block 716, process 700 includes validation of the given network device by the local activation server agent based on network device validation information for the given network device. In one example, the local activation server agent may validate the given network device in response to the local activation server agent determining that an identifier of the given network device has been registered with a particular subscription. In one example, the local activation server agent may validate the given network device in response to the local activation server agent determining that the network device has a device type compatible with the first local branch network. The validation includes the local activation server agent communicating with the given network device over the second connection.In one example, in response to validating the given network device, the local activation server agent may provide the given network device with connection details for a local central server agent. In one example, the local central server agent may correspond to a central server of the central computer system. In one example, the central server may be a cloud-based server. In one example, the connection details may include an IP address of the central server agent. In one example, the connection details may include a digital certificate.

[0080] According to Fig. 8, a system 800 includes a plurality of network devices 810 and a first branch computer network 814. The first branch computer network 814 includes a local activation server agent. The local activation server agent provides a customer credential to a cloud-based activation server connected to the first branch computer network to establish a first connection between the local activation server agent and the activation server. The activation server is connected to a plurality of branch computer networks, including the first branch computer network. In one example, the branch computer networks may include at least one of a campus network, a data center network, an edge network, or an IoT network. In one example, the customer credential may be an identifier that links the first branch network to a subscription.In one example, the local activation server agent may be one of an HA group of multiple local activation server agents. In one example, the local activation server agent may be hosted by one or more nodes of the first branch office computer network. In one example, the nodes may be physical nodes and / or virtual nodes. In one example, the node may be connected to one or more physical processors and memory.

[0081] The local activation server agent 820 retrieves network device validation information from the activation server over the first connection. The local activation server agent 820 is responsive to a first network device connecting to the first branch network and communicates with the first network device to validate the first network device based on the network device validation information. In one example, the local activation server agent establishes the first connection and retrieves the network device validation information prior to the first network connection to the first branch network. In one example, the first network device may be a layer two (L2) or layer three (L3) switch.In other examples, a network device may be a gateway, a multicast router, a bridge, a component of a Gen-Z or Compute Express Link (CXL) network, a processor device, a network interface controller (NIC), or a fabric switch that includes one or more of the foregoing devices.

[0082] According to Fig.9, a non-transitory storage medium 900 stores machine-readable instructions 910 in accordance with example implementations. The machine-readable instructions 910 correspond to a local activation server agent of a first local network. In one example, the local activation server agent may be one of an HA group of multiple local activation server agents. In one example, the local activation server agent may be hosted by one or more nodes of the first branch computer network. In one example, the nodes may be physical nodes and / or virtual nodes. In one example, the node may be connected to one or more physical processors and memory. In one example, the first local network may be a branch network. In examples, the first local network may be a campus network, a data center network, an edge network, or an IoT network.

[0083] The machine-readable instructions 910, when executed by a machine of the first local network, cause the machine to provide a cloud-based activation server with a credential associated with a subscription identifier to establish an initial connection between the local activation server agent and a central activation server. In one example, the credential may link the local activation server agent to a subscription account. The activation server maintains network device validation information for a plurality of local computer networks, including the first local branch network.

[0084] The machine-readable instructions 910, when executed by the machine, further cause the machine to retrieve, over a first connection, network device validation information corresponding to a plurality of network devices associated with the subscription identification. In examples, the network devices may include L2 and / or L3 switches. In other examples, the network devices may include one or more of the following devices: a gateway, a multicast router, a bridge, a component of a Gen-Z or Compute Express Link (CXL) network, a processor device, a network interface controller (NIC), or a fabric switch that includes one or more of the foregoing devices.

[0085] The machine-readable instructions 910, when executed by the machine, cause the machine, in response to a first network device of the plurality of network devices connected to the first local branch computer network, to communicate with the first network device to validate the first network device based on a subset of the network device validation information corresponding to the first network device. In one example, the network device validation information may associate an identifier of the first network device with a network management service subscription. In one example, the instructions 910 may cause the machine to validate the network device based on one or more other criteria. In one example, a validation criterion may be a device type of the first network device.In one example, a validation criterion may be a firmware version associated with the first network device. In another example, a validation criterion may be an indication of the compatibility of the first network device with the first local computer network.

[0086] According to sample implementations, validation of the given network device involves the local Activate Server agent receiving a device identifier for the given network device and verifying that the device has an associated license. The benefits include the availability of the local Activation Server agent supporting troubleshooting potential issues with the local network.

[0087] According to sample implementations, network device validation involves the local activation server agent receiving a device type for the given network device and verifying whether the device type is compatible with the first branch local network. The benefits include the availability of the local activation server agent to assist in troubleshooting potential local network issues.

[0088] According to sample implementations, establishing the second connection involves sending a local activation server agent address or a second connection credential to the given network device via a DHCP (Dynamic Host Control Protocol) server. One of the benefits is that the availability of the local activation server agent facilitates troubleshooting potential local network issues.

[0089] In accordance with example implementations, the local server activation agent may detect communication from a local central server agent of the first local branch computer network. In response to detecting the communication, the local server activation agent sends information to the local central server agent to enable the local central server agent to connect to a central server of the central computer system. The central server manages the network devices of the plurality of local branch computer networks. The local central server agent communicates with the central server to establish a third connection between the local central server agent and the central server. Advantages include that the use of local agents, such as the local server activation agent and the local central server agent, improves troubleshooting.In addition, the local central server agent reduces the number of network connections to the central server.

[0090] According to example implementations, the local central server agent maintains an inventory of network devices of the first local branch network. In response to the local server activation agent successfully validating the given network device, the local central server agent adds the given network device to the inventory. The benefits of using local agents, such as the local server activation agent and the local central server agent, include improving troubleshooting. Furthermore, the local central server agent reduces the number of network connections to the central server.

[0091] According to example implementations, the central server agent receives first messages from the respective network devices of the first local branch network and consolidates the first messages to provide first consolidated data. The local central manager agent sends the first consolidated data to the central server over the third connection and receives second consolidated data from the central server over the third connection. The second consolidated data is split into second messages, and the local central server agent sends the second messages to the respective network devices of the first local branch network. Advantages include the use of local agents, such as the local server activation agent and the local central server agent, improving troubleshooting. Furthermore, the local central server agent reduces the number of network connections to the central server.

[0092] According to example implementations, the local central server agent predictably retrieves firmware images for network devices on the first local branch network and stores the firmware images in a repository. Firmware upgrades for the network devices can then be performed, including retrieving the firmware images from the repository by the local central server agent. One of the benefits is that firmware upgrades for the network devices can be accelerated.

[0093] The detailed description contained herein refers to the accompanying drawings. Wherever possible, the same reference numerals are used in the drawings and the above description to refer to the same or similar parts. However, it is expressly understood that the drawings are for purposes of illustration and description only. Although several examples are described in this document, modifications, adaptations, and other embodiments are possible. Accordingly, the detailed description does not limit the disclosed examples. Instead, the proper scope of the disclosed examples may be defined by the appended claims.

[0094] The terminology used herein is for the purpose of describing specific examples only and is not intended to be limiting. The singular forms “a,” “an,” and “the” include the plural forms unless the context clearly indicates otherwise. As used herein, “plural” is defined as two or more than two. As used herein, “another” means at least a second or more. The term “connected,” as used herein, is defined as connected, either directly without any intervening elements or indirectly with at least one intervening element, unless otherwise noted. Two elements may be mechanically, electrically, or communicatively connected through a communications channel, pathway, network, or system. As used herein, the term “and / or” refers to and includes all possible combinations of the listed elements. Although the terms “first,” “second,” “third,” etc.are used here to describe various elements, those elements should not be limited by these terms, as these terms are used only to distinguish one element from another unless otherwise stated or the context indicates otherwise. As used herein, the term "includes" means includes, but is not limited to; the term "including" means includes, but is not limited to; and the term "based on" means based at least in part on.

[0095] Although the present disclosure has been described with respect to a limited number of implementations, those skilled in the art, having the benefit of this disclosure, will recognize numerous modifications and variations thereof. The appended claims are intended to cover all such modifications and variations.

Claims

[1] A process comprising: Establishing a first connection with an activation server of a central computer system by a local activation server agent of a first local branch computer network of a plurality of local branch computer networks, the activation server managing network device validation information corresponding to the plurality of local branch computer networks; Communicating, by the local activation server agent, with the activation server over the first connection to receive network device validation information for a given network device associated with an entity connected to the first local branch network; in response to connecting the given network device to the first local branch network, establishing a second connection between the given network device and the local activation server agent; and Validating the given network device by the local activation server agent based on the network device validation information for the given network device, wherein validating comprises the local activation server agent communicating with the given network device over the second connection. [2] The method of claim 1, wherein validating the given network device comprises receiving, by the local activation server agent, a device identifier of the given network device and verifying, by the local activation server agent, that the device identifier has an associated license. [3] The method of claim 1, wherein validating the network device comprises receiving, by the local activation server agent, a device type of the given network device and verifying, by the local activation server agent, that the device type is compatible with the first local branch network. [4] The method of claim 1, wherein establishing the second connection comprises sending an address of the local activation server agent and / or a credential for the second connection to the given network device by a Dynamic Host Control Protocol (DHCP) server. [5] The method of claim 1, further comprising: detecting a communication from a local central server agent of the first local branch computer network by the local server activation agent; in response to detecting the communication, sending information by the local server enabling agent to the local central server agent to enable the local central server agent to connect to a central manager, the central manager managing network devices of the plurality of local branch computer networks; and Communicate through the local central server agent with the central manager to establish a third connection between the local central server agent and the central manager. [6] The method of claim 5, further comprising: Maintaining an inventory of network devices of the first local branch computer network by the local central server agent; and in response to successful validation of the given network device by the local activation server agent, adding the given network device to the inventory by the local central server agent. [7] The method of claim 5, further comprising: Receiving initial messages from corresponding network devices of the first local branch network by the local central server agent; Consolidation of the initial messages by the local central server agent to provide initial consolidated data; Sending the first consolidated data by the local central server agent to the central manager via the third connection; Receiving second consolidated data from the central manager via the third connection by the local central server agent; Splitting the second consolidated data into second messages; and Sending the second messages by the local central server agent to the respective network devices of the first local branch network. [8] The method of claim 5, further comprising: Predictive retrieval of firmware images for network devices of the first local branch network by the local central server agent; Storing the firmware images by the local central server agent in a repository; and Performing firmware upgrades of the plurality of network devices, comprising retrieving the firmware images from the repository by the local central server agent. [9] A system comprising: a plurality of network devices, including a first network device; and a local activation server agent of a first branch computer network, the local activation agent serving to: providing a cloud-based remote activation server with a customer credential associated with the first branch network to establish a first connection between the local activation server agent and the remote activation server, the remote activation server being associated with a plurality of branch networks, including the first branch network; Retrieving network device validation information from the remote activation server over the first connection; and in response to connecting the first network device to the first branch network, communicating with the first network device to validate the first network device based on the network device validation information. [10] The system of claim 9, further comprising: a local central server agent of the first branch computer network, the local central server agent serving to: Receive connection information from the local activation server agent to enable the local central server agent to establish a second connection to a remote cloud-based central server; receive data from the multitude of network devices; and to transmit the data received from the plurality of network devices to the remote central server via the second connection. [11] The system of claim 10, wherein: the remote central server processes the data transmitted to the remote central server by the local central server agent; and the local central server agent communicates with the remote central server via the second connection to receive data representing a result of the processing. [12] The system of claim 10, wherein the data communicated from the local central server agent to the remote central server comprises at least one of: data representing statistics associated with the plurality of network devices or data representing network telemetry metrics. [13] The system of claim 10, wherein the local central server agent communicates with the remote central server over the second connection to receive data representing configuration data for the plurality of network devices. [14] The system of claim 10, wherein the local central server agent, in response to detecting a failure of the first network device, transmits data to the first network device representing a last known good configuration for the first network device. [15] The system of claim 10, wherein the local central server agent further comprises: maintains an inventory of the multitude of network devices; and in response to the local activation server agent successfully validating the first network device, adding the first network device to the plurality of network devices. [16] The system of claim 10, further comprising: a Dynamic Host Control Protocol (DHCP) server to, in response to the first network device connecting to the local computer network, provide the first network device with a local activation server agent address and a credential to connect to the local activation server agent. [17] A non-transitory storage medium that stores machine-readable instructions corresponding to a local activation server agent of a first local network and, when executed by a machine of the first local network, causes the machine to: providing a cloud-based activation server with a credential associated with a subscription identification to establish a first connection between the local activation server agent and the activation server, the activation server maintaining network device validation information for a plurality of local computer networks, including the first local branch network; retrieve, via the first connection, network device validation information corresponding to a plurality of network devices associated with the subscription identification; and in response to a first network device of the plurality of network devices connecting to the first local branch network, communicate with the first network device to validate the first network device based on a subset of the network device validation information corresponding to the first network device. [18] The storage medium of claim 17, wherein the instructions, when executed by the machine, further cause the machine to retrieve the network validation information before a network device of the plurality of network devices initially connects to the first local branch computer network. [19] The storage medium of claim 17, wherein the instructions, when executed by the machine, further cause the machine to: monitor a port for communication from a local central server agent of the first branch local computer network, the local central server agent being associated with a cloud-based central server, the central server performing network device analysis processing for the plurality of local computer networks; in response to the detection of the communication, validate the local central server agent; and in response to the local central server agent's validation, provide connection information to the local central server agent so that the local central server agent can establish a connection with the central server. [20] The storage medium of claim 19, wherein the instructions, when executed by the machine, further cause the machine, in response to the validation of the first network device, to provide connection information to the first network device to enable the first network device to establish a connection with the local central server agent.

Images