Network, configuration and monitoring systems, apparatus and methods

Abstract

The system includes a network switch with ports for connecting an endpoint device to the network and a controller in communication with the network switch.The controller has access to an endpoint devi

Description

This present invention relates to systems, apparatus and methods for monitoring a status of a computer network, reporting errors on a network, and configuring devices on a network. BACKGROUND Most organisations use computer networks to provide fast internal communication between connected endpoint devices. Larger organisations typically include endpoint devices of many different types, having different protocols for interacting with each other over the network, different ways of sending and receiving data, and exhibiting different behaviours. Businesses or facilities that require connectivity for large quantities of endpoint devices, generally include logical network segmentation and access control restrictions. Often this results in the network equipment (port) each endpoint device connects to requiring specific configuration settings according to the device type. When endpoint devices are moved between different physical locations around the site, it may be difficult to maintain consistency between the configuration of the network equipment and the configuration requirements of the endpoint devices. When the endpoint device is moved from one network port to another, the network equipment configuration may prevent the endpoint from communicating with other endpoints across the network as needed, as well as negatively impacting security controls performed by the network equipment. Having administrators reactively configure the network equipment ports according to the requirements of each individual connected endpoint device can be time-consuming and error prone. SUMMARY OF THE INVENTION According to an aspect of the invention, we provide a system for monitoring and configuring a network, the system including: network equipment including a network switch providing one or more network ports for connecting an endpoint device to the network; a controller in communication with the network switch, the controller having access to an endpoint device configuration data set including identifiers of endpoint devices and stored configuration settings associated with those endpoint devices; the network switch being configured to: detect a connection of an endpoint device to one of its network ports, and in response, send a configuration request to the controller, the configuration request including an identifier associated with the endpoint device and current configuration data relating to the configuration of the network port; and the controller being configured to: receive the configuration request, and in response, to: access a record in the endpoint device configuration data set relating to the identifier provided in the configuration request, determine a discrepancy between the current configuration of the network equipment and at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set, and communicate a configuration update to the network switch, the configuration update including updated configuration settings corresponding to the at least one stored configuration setting associated with the identified endpoint device. The controller may determine whether a discrepancy is present between the current configuration of the network equipment and the at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set and may communicate the configuration update to the network switch responsive to whether a discrepancy is present. In response to the controller determining the current configuration of the network equipment is the same as the at least one stored configuration setting, the controller may inhibit communication of the configuration update to the network switch. In response to the controller determining a discrepancy is present, the controller may communicate the configuration update to the network switch. The at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set may include a stored virtual local area network “VLAN” configuration setting. The at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set may include a security configuration setting. The controller may have access to a default security configuration setting capable of being applied for any of the one or more network ports, and the configuration update may further include the default security configuration setting. The controller may determine whether a discrepancy is present between a current virtual local area network “VLAN” associated with the network port and a stored VLAN associated with the identified endpoint device in the endpoint device configuration data set and may communicate the configuration update responsive to whether a discrepancy is present. The current configuration data relating to the configuration of the network port may comprise a VLAN ID and the stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set may comprise another VLAN ID, and the controller may determine whether a discrepancy is present between the VLAN ID and the another VLAN ID. The endpoint device configuration data set may comprise the at least one stored configuration setting associated with the identified endpoint device and a second stored configuration setting associated with the identified endpoint device. The controller may determine whether a discrepancy is present between the current configuration of the network equipment and the at least one stored configuration setting. The controller may communicate the configuration update to the network switch responsive to whether a discrepancy is present, wherein the configuration update may include updated configuration settings corresponding to the at least one stored configuration setting and the second stored configuration setting. The endpoint device configuration data set may comprise the at least one stored configuration setting associated with the identified endpoint device and a second stored configuration setting associated with the identified endpoint device, and wherein the controller may: determine whether a discrepancy is present between the current configuration of the network equipment and the at least one stored configuration setting and communicate the configuration update including the updated configuration settings corresponding to the at least one stored configuration setting responsive to whether a discrepancy is present for the at least one stored configuration setting; and determine whether a discrepancy is present between the current configuration of the network equipment and the second stored configuration setting and communicate a second configuration update including updated configuration settings corresponding to the second stored configuration setting responsive to whether a discrepancy is present for the second stored configuration setting. The at least one stored configuration setting may include a stored VLAN configuration setting and the second stored configuration setting may include a security configuration setting, or the at least one stored configuration setting may include the security configuration setting and the second stored configuration setting may include the stored VLAN configuration setting. In response to a configuration request comprising a current VLAN and an identifier associated with an endpoint device, in which the identifier does not match an identifier in the endpoint device configuration data set, the controller may determine whether a discrepancy is present between the current VLAN and a default VLAN, wherein in response to the controller determining a discrepancy is present, the controller may communicate a configuration update comprising the default VLAN to the network switch, and wherein in response to the controller determining that the current VLAN matches the default VLAN, the controller may inhibit communication of the configuration update to the network switch. In response to the controller determining a discrepancy is present between the current VLAN and the default VLAN, the controller may communicate the configuration update to the network switch, in which the configuration update may comprise the default VLAN and the default security configuration setting. The network switch may update the configuration of the network port responsive to the configuration update. According to another aspect of the invention, we provide a controller apparatus for monitoring and configuring network switches on a network, the controller apparatus configured to: communicate with one or more network switches; access an endpoint device configuration data set including identifiers of endpoint devices and stored configuration settings associated with those endpoint devices; receive a configuration request from a network switch of the one or more network switches, the configuration request including an identifier associated with an endpoint device connected to a network port of the network switch and current configuration data relating to the configuration of the network port; and in response to the configuration request, the controller apparatus is configured to: access a record in the endpoint device configuration data set relating to the identifier provided in the configuration request; determine a discrepancy between the current configuration of the network equipment and at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set; and communicate a configuration update to the network switch, the configuration update including updated configuration settings corresponding to the at least one stored configuration setting associated with the identified endpoint device. According to another aspect of the invention, we provide a computer-implemented method comprising: detecting, by a network switch, a connection of an endpoint device to a network port of the network switch; communicating, by the network switch, a configuration request to a controller in communication with the network switch in response to detecting the connection of the endpoint device, the configuration request including an identifier associated with the endpoint device and current configuration data relating to the configuration of the network port; receiving, by the controller, the configuration request; accessing, by the controller, a record in an endpoint device configuration data set, the endpoint device configuration data set including identifiers of endpoint devices and stored configuration settings associated with those endpoint devices, the record relating to the identifier provided in the configuration request; determining, by the controller, a discrepancy between the current configuration of the network equipment and at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set, and communicating, by the controller, a configuration update to the network switch, the configuration update including updated configuration settings corresponding to the at least one stored configuration setting associated with the identified endpoint device. Various aspects and features of the present invention are defined in the appended claims and within the text of the accompanying description. Example embodiments include at least a system, a controller apparatus, a method, a computer program and a machine-readable, non-transitory storage medium which stores such a computer program. BRIEF DESCRIPTION OF THE FIGURES In order that the present disclosure may be more readily understood, preferable embodiments thereof will now be described, by way of example only, with reference to the accompanying drawings, in which Figure 1 is a schematic diagram illustrating a system in accordance with embodiments of the disclosure; Figures 2A, 2B and 2C are schematic diagrams illustrating examples of endpoint device configuration data sets accessible to a controller; Figure 3 is a schematic diagram illustrating an example of flow of data for updating configuration settings; Figure 4 is a schematic flowchart illustrating a method performed by a network switch; Figure 5 is a schematic flowchart illustrating a method performed by a controller; Figures 6A, 6B and 6C are schematic diagrams illustrating examples of configuration requests; and Figure 7 is a schematic flowchart illustrating a method. We describe a system for monitoring and configuring network equipment with reference to Figure 1. When we refer to network equipment, we mean devices for enabling network functionality, including for example data transmission, secure network connectivity, data traffic flow optimisation, access control and threat detection or prevention, and device management and configuration. A non-exhaustive list of examples of network equipment includes switches, routers, bridges, repeaters, gateways, firewalls, and wireless access points. In particular, the system provides multiple network switches at various locations around the site hosting the network, for example. Each network switch typically provides multiple network ports for connecting endpoint devices to the network. The endpoint devices may be desktop computers, laptops, WiFi® access points, or any other type of equipment that is connectable to a network. In this context we will refer to such devices as endpoint devices since they effectively act as endpoints in the context of the network. A controller is provided - typically a computing device with a processor, memory, and access to a data store. The controller may be any suitable computing device operable to receive and send communications to other devices on the network. The controller has access to an endpoint device configuration data set. This endpoint device configuration data set stores identifiers of endpoint devices and one or more configuration settings associated with those endpoint devices. The identifiers may typically include the Media Access Control (MAC) address of the devices and / or the internet protocol (IP) address of the devices. The controller is operable to access at least one endpoint device configuration data set, in which the endpoint device configuration data set stores one or more identifiers for one or more endpoint devices and configuration settings associated with one or more of the endpoint devices. The configuration settings associated with a given endpoint device comprise at least one or more configuration settings to be used for network equipment (network equipment configuration settings). The network switches are configured to detect a connection of an endpoint device to one of its network ports, and in response, send a configuration request to the controller to determine whether the settings of the endpoint device and / or the connection port are optimised. In this way, it is not required for a network technician to attend the device and access the configuration settings and port settings in order to determine whether they are set up as they should be. The configuration request includes an identifier associated with the endpoint device and current configuration data relating to the configuration of the network port. The controller is configured to receive the configuration request, and in response, to access a record in the endpoint device configuration data set relating to the identifier provided in the configuration request, (e.g., the controller looks up the connected endpoint device), and then determines whether the provided configuration data sent from the network switch matches the stored settings in the data set. To do this, it determines whether there is a discrepancy between the current configuration data and the stored configuration setting associated with the identified endpoint device in the device configuration data set. If the settings are not the optimum stored settings, then the controller communicates a configuration update to the network switch, the configuration update including updated configuration settings corresponding to the stored configuration settings associated with the identified endpoint device. The network switch then receives the configuration update, and acts on it, to apply the updated settings to its network port configuration. The configuration request may include an IP address associated with the network port, and the controller can be operable to store the IP address in the device configuration data set. In this way, the current IP addresses of the endpoint devices are stored in the data set, and can be accessed when necessary to communicate with those devices, or to route communications to those devices accordingly. This is important when devices may be disconnected from network ports, and moved to other parts of the network; so that the location of the device on the network is known. The system as described allows devices to be disconnected and moved to another network port, and subsequently, when the device is reconnected at a different network port, the switch carries out this automatic configuration in the background, so that the best known configuration settings are applied automatically, and the new IP address of the devices is stored at the controller in the data set. Referring now to Figure 1, a system 100 is shown comprising a controller 110 and three network switches 120-1, 120-2 and 120-3. Figure 1 provides an example of a system in which the controller 110 can act as a central controller capable of communicating with each of the network switches 120-1, 120-2 120-3 for configuration thereof. Whilst Figure 1 shows an example system 100 comprising the controller 110 and three network switches, embodiments of the disclosure provide systems comprising any suitable number of respective network switches. In some cases, a system may comprise a controller and a single network switch. In other cases, a system may comprise a controller and a potentially large number N of respective network switches, where N may be any suitable value potentially of the order of tens or even hundreds. More generally, in embodiments of the disclosure a system comprises a controller and one or more network switches. In Figure 1, the network switches 120-1, 120-2 and 120-3 may be provided as part of a same hardware device or as part of respective hardware devices. Hence, in some examples, a system may comprise a first network device comprising one or more network switches and a second network device comprising one or more network switches. The first network device and second network device are respective devices which can independently communicate with the controller 110 to communicate configuration requests and receive configuration updates. More generally, the controller 110 may be a central controller operable to receive requests and communicate updates for managing a plurality of network switches. The network switches 120-1, 120-2 and 120-3 each include one or more network ports, in which a network port can be physically connected an endpoint device by a user to permit access to a network (e.g. a local area network). A respective network switch may comprise any suitable number of network ports. In some examples, a respective network switch may comprise a plurality of network ports each of a same port type (e.g. USB or Ethernet). In other examples, a respective network switch may comprise a plurality of network ports comprising one or more network ports having a first port type (e.g. USB) and one or more network ports having a second port type (e.g. Ethernet). The network ports may correspond to any suitable type of computer port for allowing connection of an endpoint device. The network switch may monitor a connection status of each of the physical network ports forthat network switch. Any suitable hardware and / or software based network port monitoring tool may be used for monitoring a connection status. Tools for monitoring ports are generally known and not discussed in detail. Still referring to Figure 1, the controller 110 is configured to communicate with the network switches 120-1, 120-2,120-3 either directly or indirectly (e.g. via one or more networked devices) using one or more of a wired and / or wireless communication. Any suitable wireless communication protocol may be used for communication between the controller 110 and a network switch. Suitable wireless communication protocols are generally known and are not discussed in detail. In some cases, a same wireless communication protocol may be used for communication between the controller 110 and each of the network switches. In other cases, two or more different wireless communication protocols may be used for communication between the controller 110 and the network switches. In some examples, the controller 110 and the network switches 120-1, 120-2, 120-3 are part of a same Local Area Network (LAN). The controller 110 and the network switches 120-1, 120-2, 120-3 may be located at a same building (e.g. business premises or similar) and share a same physical LAN. In some examples, the controller 110 and the network switches 120-1, 120-2, 120-3 may be located on a same floor of a building and share a same physical LAN, with different floors of the building corresponding to separate LANs. Hence, in some examples, a user may connect an endpoint device (such as a laptop, printer or other mobile device). Endpoint device configuration data set The controller 110 is operable to access at least one end point device configuration data set storing identifiers of endpoint devices and configuration settings associated with those endpoint devices. The controller 110 may comprise storage circuitry (e.g. any suitable volatile memory and / or nonvolatile memory) to store at least one endpoint device configuration data set. Alternatively or in addition, the controller 110 may access a datastore using one or more of a wired and / or wireless communication to access at least one endpoint device configuration data set. Figure 2A schematically illustrates an example of an endpoint device configuration data set. In this example, the data set comprises an endpoint device identifier field 210 and a configuration setting field 220. The endpoint device identifier field 210 and configuration setting field 220 each include a plurality of entries (shown as rows in Figure 2A). A respective entry in the endpoint device identifier field 210 includes a respective identifier for a respective endpoint device. A respective entry in the configuration setting field 220 includes one or more configuration settings associated with a respective endpoint device. Endpoint devices may have unique identifiers in the form of medium access control (MAC) addresses and / or IP addresses. In some embodiments of the disclosure, each entry in the endpoint device identifier field 210 may store at least one of a MAC address and an IP address associated with a respective endpoint device. For example, the endpoint device identifier field 210 may comprise a plurality of respective entries, in which each respective entry comprises a respective MAC address for a respective endpoint device. The identifier field 210 may comprise N respective entries corresponding to N respective endpoint devices expected to be used on a network (e.g. a local area network “LAN”) and / or at a site (e.g. a business facility). Each of the N entries may thus comprise a respective MAC address (or other similar unique identifier for an endpoint device) corresponding to a respective endpoint device. As shown in Figure 2A, each entry in the endpoint device identifier field 210 has an associated entry in the configuration setting field 220. Therefore, using an identifier for a given endpoint device, an entry (also referred to as a record) in the configuration setting field 220 relating to the identifier provided in the configuration request can be accessed, in which the accessed entry includes one or more configuration settings associated with a respective endpoint device. In some examples, the configuration setting field 220 may comprise a plurality of respective entries, in which each respective entry comprises one or more network equipment configuration settings capable of being used to configure network equipment when connected to an endpoint device. More generally, a first respective entry in the configuration setting field 220 may comprise a first network equipment configuration setting to be used for a network switch when connected to a first endpoint device. Similarly, a second respective entry in the configuration setting field 220 may comprise a second network equipment configuration setting to be used for a network switch when connected to a second endpoint device. In some embodiments of the disclosure, the configuration setting field may correspond to a virtual local area network (VLAN) setting field. Figure 2B schematically illustrates an example of an endpoint device configuration data set comprising the endpoint device identifier field 210 (as already discussed with respect to Figure 2A) and a VLAN setting field 220a. In a similar manner to that discussed above with respect to Figure 2A, in Figure 2B each entry in the endpoint device identifier field 210 has an associated entry in the VLAN configuration setting field 220a. Therefore, using an identifier for a given endpoint device, an associated entry in the VLAN configuration setting field 220a can be identified. Figure 2B provides an example of an endpoint device configuration data set that may be accessible to the controller 110. As discussed in more detail later, the endpoint device configuration data set as shown in Figure 2B may be accessed by the controller for VLAN discrepancy determining. In some embodiments of the disclosure, a local area network (LAN) may be logically divided into a plurality of VLANs, for which one or more endpoint devices are intended to have access to a first VLAN and one or more other endpoint devices are intended to have access to a second VLAN. The components shown in Figure 1 may be connected to a same LAN, and the LAN may be logically divided into two or more VLANs. The techniques of the present disclosure, can allow automatic reconfiguring of VLAN configuration settings associated with network ports to maintain consistency between VLAN configuration settings of network ports and VLAN configuration setting requirements for endpoint devices. A respective entry in the VLAN setting field 220a may include a VLAN configuration setting which can be applied to a network switch so that an endpoint device connected to the network switch is connected to a specific VLAN specified by the VLAN configuration setting. In some cases, a respective entry in the VLAN setting field 220a may include a unique identifier (e.g. VLAN ID) associated with a VLAN configuration setting (e.g. a VLAN IP address, VLAN name and / or other VLAN configuration settings). In some cases, a respective entry in the VLAN setting field 220a may comprise both the VLAN configuration setting and the unique identifier, or just the unique identifier may be stored in the respective entry and a separate field may be provided for storing the VLAN configuration setting in association with the unique identifier. In some embodiments of the disclosure, the configuration setting field may comprise two or more sub-fields each corresponding to a different type of configuration setting. Figure 2C schematically illustrates an example of an endpoint device configuration data set comprising the endpoint device identifier field 210, the VLAN setting field 220a and a security setting field 220b. In Figure 2B, an entry in the endpoint device identifier field 210 thus has an associated entry in each of the VLAN setting field 220a and the security setting field 220b. Figure 2B thus provides another example of an endpoint device configuration data set that may be accessible to the controller 110. As discussed in more detail later, the endpoint device configuration data set as shown in Figure 2C may be accessed by the controller for one or more of VLAN discrepancy determining and security setting discrepancy determining. In some embodiments, a discrepancy determining operation may be performed using one of a stored VLAN setting and a stored security setting and in response to determined presence of a discrepancy, both the stored VLAN and the stored security setting may be communicated as an update to a network switch. Still referring to Figure 2C, a respective entry in the security setting field 220b may include at least a security configuration setting which can be applied to a network switch. In some cases, a respective entry in the security setting field 220b may include a unique identifier (e.g. security ID) associated with a security configuration setting. In some cases, a respective entry in the security setting field 220b may comprise both the security configuration setting and the unique identifier, or just the unique identifier may be stored in the respective entry and a separate field may be provided for storing the security configuration setting in association with the unique identifier. A stored security setting associated with an endpoint device may specify one of: none; open and closed. A setting of “none” corresponds to no security restrictions. A setting of “open” corresponds to security restrictions to be applied based on dynamically learned endpoint characteristics (e.g. specified based on MAC address). A setting of “closed” corresponds to security restrictions to be applied based on interaction with an 802.1x supplicant running on the endpoint device. In some cases, entries in the security setting field 220b may be used to store specific security configuration settings (e.g. custom security configuration settings) associated with endpoint devices thus providing improved system security. It will be appreciated that whilst Figure 2C shows an example comprising both the VLAN setting field 220a and the security setting field 220b, in some embodiments of the disclosure an endpoint device configuration data set may comprise the endpoint device identifier field 210 and the security setting field 220b (i.e. without the VLAN setting field 220a). Such an endpoint device configuration data set may be accessed by the controller for security setting discrepancy determining. More generally, an endpoint device configuration data set may comprise the endpoint device identifier field 210, the VLAN setting field 220a and another setting field (e.g. the security setting field 220b) comprising entries for storing one or more other configuration settings associated with endpoint devices (e.g. one or more additional attributes may be defined by a user and stored in entries of the another setting field for allowing use of such attributes). In response to receiving a request from a network switch which includes an endpoint device identifier and current configuration data relating to a current configuration of a port of the network switch, the controller is operable to identify at least one entry in the configuration setting field 220 (e.g. the VLAN setting field 220a and / or the security setting field 220b), and at least one stored configuration setting in an identified entry can be used for determining whether a discrepancy is present. The controller 110 is thus operable to perform one or more discrepancy determining operations using at least one stored configuration setting, and in response to determining presence of a discrepancy between a current configuration of a network port and the at least one stored configuration setting, the controller is operable to communicate a configuration update including the at least one stored configuration setting to the network switch. In some embodiments of the disclosure, in addition to the endpoint device configuration data set, the controller may have access to one or more default configuration settings. The one or more default configuration settings are not associated with a specific endpoint device. The one or more default configuration settings may have been defined in advance by a developer for use with a specific system and / or specific premises I site. The one or more default configuration settings may comprise one or more default security settings for the system and / or a default VLAN setting for the system. The one or more default configuration settings can be accessible to the controller and may be capable of being applied for any of the network ports of the system. Hence, in some embodiments of the disclosure, the controller may comprise storage circuitry storing one or more of the endpoint device configuration data sets according to one or more of Figures 2A, 2B and 2C, and also one or more default configuration settings (e.g. a default VLAN setting for the system and / or one or more default security settings for the system). Any of the above-mentioned endpoint device configuration data sets may accessible to the controller for discrepancy determining with respect to current configuration data included in a configuration request received from a network switch. In some cases, in response to receiving a configuration request including an endpoint device identifier that does not match an endpoint device identifier in an endpoint device configuration data set, the controller may be operable to access one or more of the default configuration settings for discrepancy determining with respect to current configuration data included in that configuration request. For example, in response to receiving a configuration request including a current VLAN setting for a network port and an endpoint device identifier (e.g. MAC address) that does not match an endpoint device identifier in an endpoint device configuration data set, the controller may perform a discrepancy determining operation using the current VLAN setting and a default VLAN setting. In response to determining presence of a discrepancy, the controller can thus communicate a configuration update comprising the default VLAN setting. Optionally, one or more of the default configuration settings may also be included in the configuration update. This is discussed in more detail later. Automatic configuration of network equipment Figure 3 schematically illustrates an example of flow of data and interaction between the controller 110 and a network switch 120 (such as any of 120-1, 120-2, 120-3, for example). At a step 310, the network switch detects a connection of an endpoint device to one of its network ports. At a step 320, the network switch sends a configuration request to the controller, the configuration request being sent responsive to the detection at the step 310. The configuration request comprises an identifier associated with the endpoint device and current configuration data relating to a current configuration of the network port. At a step 330, the controller receives the configuration request and accesses at least one record (also referred to as an entry) in an endpoint device configuration data set (e.g. as discussed above with respect to Figures 2A, 2B and 2C) associated with the identifier provided in the configuration request, in which the at least one accessed record comprises at least one stored configuration setting associated with the endpoint device. At a step 340, the controller determines a discrepancy between the current configuration data and one or more of the stored configuration settings associated with the endpoint device. Moreover, in the example of Figure 3, at the step 340 the controller determines whether a discrepancy is present between at least some of the current configuration data included in the configuration request and at least one stored configuration setting associated with the at least one accessed record. In response to determining presence of a discrepancy, the controller proceeds to a step 360. In response to the step 340 not determining presence of a discrepancy (or put differently, determining absence of a discrepancy), the controller proceeds to a step 350 to end the processing in respect of the configuration request received at the step 330. The operations at the step 340 may take a number of different forms and further details of the step 340 are discussed in more detail later. At a step 360, the controller communicates a configuration update to the network switch. The configuration update comprises one or more updated configuration settings for one or more of the network port and / or the endpoint device. The one or more updated configuration settings correspond to the at least one stored configuration setting used at the step 340 for the discrepancy determining. At a step 370, the network switch updates at least one configuration setting of the network port in response to the communicated configuration update. Therefore, in response to a user connecting an endpoint device to a network port, the operations discussed above with respect to Figure 3 can be automatically performed so that, when appropriate, a configuration update is communicated to the network switch and applied for the network port. Still referring to Figure 3, the network switch 120 may comprise any suitable number of network ports and the techniques discussed above with respect to Figure 3 may be performed for any number of network ports. For example, the network switch may detect connection of a first endpoint device to a first network port at a first time. The network switch and the controller may proceed according to the steps shown in Figure 3 for updating one or more configuration settings for the first network port in response to the detection of the connection of the first endpoint device to the first network port (if needed according to the determination at the step 340). The network switch may subsequently detect connection of a second endpoint device to a second network port at a second time later than the first time. The network switch and controller may proceed according to the steps shown in Figure 3 for updating one or more configuration settings for the second network port in response to the detection of the connection of the second endpoint device to the second network port (if needed according to the determination at the step 340). Figure 4 is a schematic flowchart illustrating a method 400 that may be performed by a network switch. Referring to the method 400 in Figure 4, at a step 410 the network switch (e.g. network switch 120-1, 120-2 or 120-3) detects a connection of an endpoint device to one of its network ports. At a step 420, the network switch communicates a configuration request to a controller, in which the configuration request comprises an identifier associated with the endpoint device and current configuration data relating to the current configuration of the network port. At a step 430, the network switch receives a configuration update from the controller, in which the configuration update comprises one or more updated configuration settings for updating the current configuration of the network port. At a step 440, the network switch updates the current configuration of the network port in dependence on the received configuration update. The network switch may be capable of performing the method 400 for any of the network ports of that network switch. The network switch may perform an instance of the method 400 in response to connection of an endpoint device to a first network port, and may perform another instance of the method 400 in response to connection of an endpoint device to a second network port. The network switch may be capable of performing a number of instances of the method 400 potentially in parallel (i.e. at least partially simultaneous) with respect to a corresponding number of network ports. Figure 5 is a schematic flowchart illustrating a method 500 that may be performed by a controller. Referring to the method 500 in Figure 5, at a step 510 the controller receives a configuration request from a network switch, in which the configuration request comprises an identifier associated with an endpoint device detected as being connected to a network port of the network switch and current configuration data relating to the current configuration of the network port. At a step 520, the controller accesses, in an endpoint device configuration data set accessible to the controller (e.g. as discussed above with respect to Figures 2A, 2B and 2C), at least one record (also referred to as an entry) relating to the identifier provided in the configuration request, in which the at least one accessed record comprises at least one stored configuration setting associated with the endpoint device. At a step 530, the controller determines a discrepancy between the current configuration data and the at least one stored configuration setting. At a step 540, the controller communicates a configuration update to the network switch, in which the configuration update comprises one or more updated configuration settings for the network. The one or more updated configuration settings correspond to one or more stored configuration settings included in the at least one accessed record. Figure 5 represents an example method in which the step 530 determines a discrepancy and thus communicates the configuration update. As explained previously, at the step 530 the controller apparatus may determine no discrepancy (or put differently may determine that there is no difference between the at least one stored configuration setting and the current configuration data. In response to such a determination by the controller apparatus, the controller apparatus is operable to inhibit (e.g. prevent) communication of the configuration update to the network switch. The controller (also referred to as a controller apparatus) may be capable of performing the method 500 for any suitable number of network ports. The controller may perform a first instance of the method 500 in response to receiving a first configuration request associated with a first network port, and may perform a second instance of the method 500 in response to receiving a second configuration request associated with a second network port, in which the first and second instances of the method 500 may potentially be run in parallel. More generally, in embodiments of the disclosure a controller apparatus for monitoring and configuring network switches on a network is configured to: communicate with one or more network switches; access an endpoint device configuration data set including identifiers of endpoint devices and stored configuration settings associated with those endpoint devices; receive a configuration request from a network switch of the one or more network switches, the configuration request including an identifier associated with an endpoint device connected to a network port of the network switch and current configuration data relating to the configuration of the network port; and in response to the configuration request, the controller apparatus is configured to: access a record in the endpoint device configuration data set relating to the identifier provided in the configuration request, determine a discrepancy between the current configuration of the network equipment and at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set, and communicate a configuration update to the network switch, the configuration update including updated configuration settings corresponding to the at least one stored configuration setting associated with the identified endpoint device. In embodiments of the disclosure, the controller (also referred to as a controller apparatus) is operable to perform a discrepancy determining operation. The discrepancy determining operation at the controller can contribute to improving processing efficiency for a system comprising the controller and one or more network switches. For example, communication of redundant updates from the controller to the network switch (or network switches) and / or processing of redundant updates by network switches can be reduced or removed. Furthermore, the discrepancy determining operation at the controller can allow provision of a system in which one or more network switches can potentially have a reduced or lower hardware specification and / or reduced computational load. A discrepancy determining operation can be performed by the controller and, in response to receiving one or more configuration updates, such updates can be automatically implemented by the network switch (or network switches) without requiring an evaluation of the updates by the network switch. Figures 6A, 6B and 6C are schematic diagrams illustrating examples of configuration requests that may be communicated by network switches and received by the controller. Figure 6A shows an example in which a configuration request 600a includes the identifier associated with the endpoint device without any data relating to a current configuration of a network port. In this case, using any of the datasets discussed previously with respect to Figures 2A, 2B and 2C, the controller can be operable to access a record in an endpoint device configuration data set relating to the identifier provided in the configuration request and communicate a configuration update comprising one or more stored configuration settings included in the accessed record. Provision of such a configuration request can allow identification by the controller of stored configuration settings associated with an endpoint device. However, provision of such a configuration request does not permit a discrepancy determining operation by the controller. Moreover, in this case the controller can simply identify one or more stored configuration settings and communicate this to a network switch. This can potentially result in communication of redundant updates and / or increased computational work by network switches to process and determine whether to implement updates (or implement some or all of the updates). In embodiments of the disclosure, a configuration request communicated by a network switch comprises an identifier for an endpoint device and current configuration data for a network port connected with the endpoint device. Figure 6B schematically illustrates an example of a configuration request 600b comprising an identifier for an endpoint device and current configuration data for a network port connected with the endpoint device. Provision of the identifier allows accessing by the controller of one or more stored configuration settings associated with the endpoint device. Provision of the current configuration data allows a discrepancy determining operation by the controller based on the current configuration data and at least one stored configuration setting. In response to determining presence of at least one discrepancy between the current configuration data and the at least one stored configuration setting, a configuration update comprising the at least one stored configuration setting is communicated for use by the network switch to update the current configuration of the network port to conform to the at least one stored configuration setting. In response to the discrepancy determination not determining presence of at least one discrepancy between the current configuration data and the stored configuration data, the processing by the controller in respect of the configuration request can be ended with no update being communicated to the network switch. Accordingly, the controller can thus inhibit communication of the configuration update to the network switch. The controller may thus receive a configuration request from a network switch and determine, via the discrepancy determining operation, that no configuration update is needed for the network switch. Therefore, a single communication (i.e. the communication of the configuration request from the network switch to the controller) can be required between the network switch and the controller for such cases. This may be particularly beneficial for improving processing efficiency for sites where users frequently connect and disconnect a same endpoint device to and from a given network port. For such sites, the disclosed techniques can inhibit (e.g. prevent) communication of redundant updates and processing of such updates at network switches thus providing technical advantages in terms of system operational efficiency, hardware requirements and / or computational loads for network switches. Figure 6C schematically illustrates an example of a configuration request 600c comprising an identifier for an endpoint device and in which the current configuration data for the network port connected with the endpoint device corresponds to a current VLAN for the network port and a current security setting for the network port. Figure 6C shows an example in which both the current VLAN and the current security setting are included in the configuration request. In some cases, one of the current VLAN and the current security setting may be provided in the configuration request. Hence, in some embodiments of the disclosure, a configuration request comprises an endpoint device identifier and at least one of a current VLAN and a current security setting associated with a network port connected to the endpoint device. Generally speaking, the data included in the configuration request (e.g. the current VLAN and / or current security setting) can be used with stored data in one or more entries of the endpoint device configuration data set for performing a discrepancy determining operation. Examples of discrepancy determining and configuration updates Discrepancy determining by the controller may take a number of different forms. The endpoint device configuration data set and configuration requests may take various forms as discussed previously with respect to the examined in Figures 2A-2C and 6A-6C and it will be appreciated that various combinations of the endpoint device configuration data sets and configuration requests can be used. In some examples, the configuration request 600b or the configuration request 600c and the endpoint device configuration data set as described with reference to Figure 2B or Figure 2C may be used together. The controller may be operable to perform one or more of a VLAN discrepancy determining operation and a security setting discrepancy determining operation. In the following discussion the term VLAN discrepancy refers to a discrepancy between a current VLAN associated with a network port connected to an endpoint device and a stored VLAN associated with the identified endpoint device in the endpoint device configuration data set. Similarly, the term a security setting discrepancy refers to a discrepancy between a current security configuration setting associated with a network port connected to an endpoint device and a stored security configuration setting associated with the identified endpoint device in the endpoint device configuration data set. VLAN discrepancy examples In some embodiments of the disclosure, the controller is configured to receive a configuration request associated with a network port connected to an endpoint device, determine whether a VLAN discrepancy is present based on the configuration request and a stored configuration setting associated with the identified endpoint device in an endpoint device configuration data set, and communicate a configuration update to the network switch including the network port in response to the controller determining presence of the VLAN discrepancy. In some embodiments of the disclosure, in response to determining presence of a VLAN discrepancy, the configuration update communicated by the controller comprises the stored VLAN associated with the identified endpoint device in the endpoint device configuration data set. In this way, the stored VLAN can be communicated to the network switch as an update for updating the network port to the stored VLAN configuration setting. In some embodiments of the disclosure, in response to determining presence of a VLAN discrepancy, the controller may also include a default security setting for the system (as discussed earlier) in the configuration update. For example, using a configuration request comprising an endpoint device identifier and a current VLAN associated with the network port together with the endpoint device configuration data set in Figure 2B (or indeed Figure 2C), the controller can be operable to determine whether a discrepancy is present between the current VLAN and a stored VLAN. In response to determining presence of a VLAN discrepancy, the controller can communicate a configuration update comprising the stored VLAN and also the default security setting. The default security setting may be a default configuration setting that is defined in advance by a developer according to the specific system and / or premises / site. The default security setting may be capable of being applied for any of the one or more network ports of the system. More generally, presence of the VLAN discrepancy serves to indicate that VLAN re-configuration is needed for the network port. In addition to sending a VLAN update (i.e. the stored VLAN) to the network switch, the controller can also, optionally, transmit the default security setting. The default security setting can be included in a same update message as the stored VLAN. Hence more generally, in some embodiments of the disclosure, in response to determining a VLAN discrepancy, the controller may communicate a configuration update comprising the stored VLAN setting associated with an identified endpoint device in the endpoint device configuration data set and also the default security configuration setting capable of being applied for any of the one or more network ports. Alternatively or in addition, in some embodiments of the disclosure, in response to determining presence of a VLAN discrepancy, the controller may also include a stored security configuration setting associated with the identified endpoint device in the endpoint device configuration data set in the configuration update. For example, using a configuration request comprising an endpoint device identifier and a current VLAN associated with the network port together with the endpoint device configuration data set in Figure 2C, the controller can be operable to determine whether a discrepancy is present between the current VLAN and a stored VLAN. In response to determining presence of a VLAN discrepancy, the controller can communicate a configuration update comprising the stored VLAN and also an associated stored security setting in the security setting field 220b. As explained previously, a stored security setting in the security setting field 220b may comprise one or more device-specific or device-type specific security settings. This can contribute to improving system security. Hence, in some embodiments of the disclosure in response to determining a VLAN discrepancy, the controller may communicate a configuration update comprising both the stored VLAN setting and the stored security setting associated with an identified endpoint device in the endpoint device configuration data set. Endpoint devices may be grouped according to one or more properties and a same security configuration setting may be stored for each of the endpoint devices in a same group. For example, referring to the data set in Figure 2C, endpoint devices may be grouped based on one or more of: a VLAN setting; a device type; a MAC address; and an IP address. Endpoint devices in a same group may each have a same security configuration setting. For example, endpoint devices corresponding to a first VLAN setting may each have a first security configuration setting, and endpoint devices corresponding to a second VLAN setting may each have a second security configuration setting. Alternatively, endpoint devices corresponding to a first device type may each have a first security configuration setting, and endpoint devices corresponding to a second device type may each have a second security configuration setting. For example, the first device type may correspond to a printer device type and the second device type may correspond to a camera (e.g. CCTV camera) device type. In some embodiments of the disclosure, the configuration request (or more specifically the current configuration data in the configuration request) comprises a VLAN identifier (VLAN ID) and the stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set comprises another VLAN identifier (VLAN ID), and the controller is configured to determine whether a discrepancy is present between the VLAN identifier and the another VLAN identifier. For example, the configuration request may include a current VLAN ID (e.g. a number or alphanumeric code or other similar ID) and the endpoint device configuration data set may similarly include an entry storing a stored VLAN ID. In some examples, VLAN IDs in the range 0-4095 may be used. As explained above with reference to Figure 2B, a same entry in the endpoint device configuration data set may store both a VLAN ID and a VLAN configuration setting (e.g. a VLAN IP address, VLAN name and / or other VLAN configuration settings) or these may be stored in separate, and associated, entries so that an entry including the VLAN ID can be used forthe discrepancy determining operation and, if present, one or both of the VLAN ID and the associated VLAN configuration setting can be communicated as an update to the network switch. Hence, references to determining whether a discrepancy is present between a current VLAN associated with a network port and a stored VLAN associated with an identified endpoint device in an endpoint device configuration data set refer to using VLAN configuration settings (e.g. comparing VLAN names and / or VLAN IP address and / or other VLAN parameters) for discrepancy determining or using VLAN IDs (e.g. comparing two VLAN IDs) for discrepancy determining. Generally, processing efficiency can be improved by performing discrepancy determining using VLAN IDs since VLAN IDs may typically have a smaller size (e.g. a single numerical value or a numerical value in the range 0-4095), allowing for faster and more efficient discrepancy determining. For example, a current VLAN ID configuration included in a configuration request may have a value of 1035. In response to configuration request, the controller may access a stored VLAN ID in an entry in the endpoint device configuration data set which may also have a value of 1035. Accordingly in this case, the controller determines that the VLAN IDs are the same and the controller can be operable to inhibit communication of a configuration update to the network switch for this situation. In another example, the stored VLAN ID configuration stored in the endpoint device configuration data may instead have a different value (e.g. 1040). In this case, the controller determines presence of a VLAN discrepancy and communicates the configuration update to the network switch. Security setting discrepancy examples Any of the above mentioned techniques discussed with respect to the VLAN discrepancy examples may be similarly performed instead using a current security setting in a configuration request and a stored security setting in an entry in the endpoint device configuration data set for discrepancy determining. In some embodiments of the disclosure, the controller is configured to receive a configuration request associated with a network port connected to an endpoint device, determine whether a security setting discrepancy is present based on the configuration request and a stored configuration setting associated with the identified endpoint device in an endpoint device configuration data set, and communicate a configuration update to the network switch including the network port in response to the controller determining presence of the security setting discrepancy. In some embodiments of the disclosure, in response to determining presence of a security setting discrepancy, the controller may also include the default security setting for the system (as discussed earlier) in the configuration update. For example, using a configuration request comprising an endpoint device identifier and a current security setting associated with the network port together with the endpoint device configuration data set in Figure 2C (or an endpoint device configuration data set without the VLAN setting field 220a), the controller can be operable to determine whether a discrepancy is present between the current security setting and a stored security setting. In response to determining presence of a security setting discrepancy, the controller can communicate a configuration update comprising the stored security setting and also the default security setting. Hence, both a default security setting and a device-specific (or deice-type specific) security setting can be applied to the network port. This can improve system security. If for example there is a conflict between the default security setting and the stored security setting associated with the identified endpoint device in the endpoint device configuration data set, then the controller may be operable to determine presence of the conflict and communicate the stored security setting without communicating the default security setting. More generally, presence of the security setting discrepancy may serve to indicate that security setting re-configuration is needed for the network port. In addition to sending a security update (i.e. at least the stored security setting) to the network switch, the controller can also, optionally, transmit a stored VLAN setting. Hence more generally, in some embodiments of the disclosure, in response to determining a security setting discrepancy, the controller may communicate a configuration update comprising both the stored security setting and the stored VLAN setting associated with an identified endpoint device in the endpoint device configuration data set. The above examples refer to the controller being operable to perform one of a VLAN discrepancy determining operation and a security setting determining operation for triggering communication of a configuration update. In the above examples, the controller may communicate a configuration request comprising any of a stored VLAN, a stored security setting, and one or more default security settings responsive to a single discrepancy determining operation. In other examples, the controller may be operable to use a combination of VLAN discrepancy determining and security setting discrepancy determining. Hence more generally, in some embodiments of disclosure an endpoint device configuration data set comprises a first stored configuration setting associated with an identified endpoint device and a second stored configuration setting associated with the identified endpoint device, wherein the controller is configured to determine whether a discrepancy is present between the current configuration of the network equipment and at least the first stored configuration setting, and the controller is configured to communicate the configuration update to the network switch responsive to whether a discrepancy is present, wherein the configuration update includes updated configuration settings corresponding to the first stored configuration setting and the second stored configuration setting. As explained above with reference to Figures 2A-C, in some cases an endpoint device configuration data set may comprise the endpoint device identifier field 210, the VLAN setting field 220a and another setting field (e.g. the security setting field 220b) comprising entries for storing one or more other configuration settings associated with endpoint devices. In some embodiments of the disclosure, the first stored configuration setting includes a stored VLAN configuration setting and the second stored configuration setting includes a security configuration setting, or the first stored configuration setting includes the security configuration setting and the second stored configuration setting includes the stored VLAN configuration setting. In some embodiments of the disclosure the controller may receive the configuration request 600c which is suitable for allowing one or both of VLAN discrepancy determining and security setting discrepancy determining. In some embodiments of the disclosure, the controller may perform VLAN discrepancy determining and communicate a stored VLAN responsive to determining a VLAN discrepancy, and may perform security setting discrepancy determining and communicate a stored security setting responsive to determining a security setting discrepancy. The VLAN discrepancy determining and security setting discrepancy determining may be performed in parallel (e.g. at least partially in parallel) or in order. The order is not particularly limited. Hence more generally, VLAN discrepancy determining may be performed to determine whether to communicate a VLAN update, and security setting discrepancy determining may be performed to determine whether to communicate a security update. Moreover, the controller may receive a configuration request (e.g. configuration request 600c) which is suitable for allowing both of VLAN discrepancy determining and security setting discrepancy determining with respect to a network port connected to an endpoint device. In response to the controller determining a current VLAN associated with the network port is the same as a stored VLAN associated with the identified endpoint device in the endpoint device configuration data set, the controller may inhibit communication of the stored VLAN as an update. In response to the controller determining the current VLAN associated with the network port differs from the stored VLAN associated with the identified endpoint device in the endpoint device configuration data set, the controller may communicate a configuration update comprising the stored VLAN. In response to the controller determining a current security setting associated with the network port is the same as a stored security setting associated with the identified endpoint device in the endpoint device configuration data set, the controller may inhibit communication of the stored security setting as an update. In response to the controller determining the current security setting associated with the network port differs from the stored security setting associated with the identified endpoint device in the endpoint device configuration data set, the controller may communicate a configuration update comprising the stored security setting. For example, the controller may be operable to communicate a first configuration update comprising the stored VLAN responsive to whether there is a discrepancy between the current VLAN and the stored VLAN, and the controller may be operable to communicate a second configuration update comprising the stored security setting responsive to whether there is a discrepancy between the current security setting and the stored security setting. Accordingly, one or both of the first configuration update and the second configuration update may be communicated or inhibited from being communicated depending on the circumstances. The first and second configuration updates may be included in a same message (e.g. communicated together in a same packet) or communicated separately. In some examples, VLAN discrepancy determining may be performed first, and if no discrepancy is present then the controller may end the processing in respect of the configuration request (i.e. end the process without security setting discrepancy determining). VLAN discrepancy determining may be performed first, and if a discrepancy is present then the controller may proceed to perform the security setting discrepancy determining. Accordingly, in this latter case, the controller can be operable to communicate a configuration update comprising a stored VLAN and optionally a stored security setting depending on a result of the security setting discrepancy determining. In this way, VLAN discrepancy determining can be used to determine whether to subsequently perform security setting discrepancy determining prior to communicating a configuration update, thus potentially improving processing efficiency. More generally, the controller may be operable to selectively inhibit communication of any of one or more stored configuration settings (or any of a plurality of stored configuration settings) associated with an endpoint device responsive to an outcome of a discrepancy determining operation for any of the one or more (or plurality of) stored configuration settings. Examples using default VLAN In some cases, the controller may receive a configuration request comprising an endpoint device identifier that does not match an endpoint device identifier in an endpoint device configuration data set. This may occur for a number of possible reasons such as a new or non-registered endpoint device being used. In some embodiments of the disclosure, in response to a configuration request comprising a current VLAN and an identifier associated with an endpoint device, in which the identifier does not match an identifier in the endpoint device configuration data set, the controller may determine whether a discrepancy is present between the current VLAN and a default VLAN (a default system VLAN specified for the system), wherein in response to the controller determining a discrepancy is present, the controller may communicate a configuration update comprising the default VLAN to a network switch, and wherein in response to the controller determining that the current VLAN matches the default VLAN, the controller may inhibit communication of the configuration update to the network switch. In response to controller determining that the current VLAN matches the default VLAN, the controller may thus determine that the configuration of the network equipment is already at the default setting. In some embodiments of the disclosure, in response to the controller determining a discrepancy is present between the current VLAN and the default VLAN, the controller may communicate the configuration update to the network switch, in which the configuration update comprises the default VLAN and also one or more of the default security configuration settings. Referring again to the method in Figure 3, at the step 330 the controller may access an endpoint device configuration data set and determine whether an endpoint device identifier in the configuration request matches an endpoint device identifier in the endpoint device configuration data set. In response to determining a match, the method can proceed as discussed previously when discussing Figure 3. In response to determining that the endpoint device identifier in the configuration request does not match an endpoint device identifier in the endpoint device configuration data set, the method can proceed to access a default VLAN, and the step 340 can be performed using the default VLAN for VLAN discrepancy determining. Responsive to the outcome of the step 340, the method may then proceed in the manner already discussed above when discussing Figure 3. Similar to what has been discussed above, the default VLAN may comprise one of more of a unique identifier (e.g. VLAN ID) and / or one or more VLAN configuration settings (e.g. VLAN name and / or VLAN IP address and / or other VLAN parameters). For example, at the step 340 the controller may determine whether there is a discrepancy between the default VLAN and the current VLAN according to a comparison of two VLAN IDs. More generally, using the default VLAN and the configuration request the controller can determine whether a VLAN re-configuration is required for a network port. In response to determining the VLAN discrepancy based on the default VLAN, the controller may optionally include the default security configuration setting capable of being applied for any of the one or more network ports in the configuration update. Hence, in some embodiments of the disclosure, the controller may communicate a configuration update comprising the default VLAN and the default security configuration setting. More generally, for an endpoint device connected to a network port which has not previously been registered (i.e. not registered in the endpoint device configuration data set), the controller can be operable to communicate the default VLAN and the default security configuration setting. Of course, if the network port was last used by another endpoint device that also has not previously been registered, then the VLAN discrepancy determining by the controller will determine that a VLAN re-configuration is not required (since the network port in this case will already have the default VLAN applied) and accordingly the controller can inhibit communication of a configuration update thus improving processing efficiency. The above techniques refer to using the default VLAN for VLAN discrepancy determining. It will be appreciated that the above technique can be performed similar to that discussed above to use the default security configuration setting for security discrepancy determining. Similarly, a combination of VLAN discrepancy determining and security discrepancy determining may also be used, similar to what has been discussed previously. For example, VLAN discrepancy determining using the default VLAN may be performed first and security discrepancy determining using the default security configuration setting may be performed second conditional on determining presence of a VLAN discrepancy. Figure 7 is a schematic flowchart illustrating a method 700. The method comprises detecting (at a step 710), by a network switch, a connection of an endpoint device to a network port of the network switch; communicating (at a step 720), by the network switch, a configuration request to a controller in communication with the network switch in response to detecting the connection of the endpoint device, the configuration request including an identifier associated with the endpoint device and current configuration data relating to the configuration of the network port; receiving (at a step 730), by the controller, the configuration request; accessing (at a step 740), by the controller, a record in an endpoint device configuration data set, the endpoint device configuration data set including identifiers of endpoint devices and configuration settings associated with those endpoint devices, the record relating to the identifier provided in the configuration request; determining (at a step 750), by the controller, a discrepancy between the current configuration of the network equipment and the stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set, and communicating (at a step 760), by the controller, a configuration update to the network switch, the configuration update including updated configuration settings corresponding to the stored configuration settings associated with the identified endpoint device. When used in this specification and claims, the terms "comprises" and "comprising" and variations thereof mean that the specified features, steps or integers are included. The terms are not to be interpreted to exclude the presence of other features, steps or components. The invention may also broadly consist in the parts, elements, steps, examples and / or features referred to or indicated in the specification individually or collectively in any and all combinations of two or more said parts, elements, steps, examples and / or features. In particular, one or more features in any of the embodiments described herein may be combined with one or more features from any other embodiment(s) described herein. Although certain example embodiments of the invention have been described, the scope of the appended claims is not intended to be limited solely to these embodiments. The claims are to be construed literally, purposively, and / or to encompass equivalents. It will be appreciated that example embodiments can be implemented by computer software operating on a general purpose a computing system. In these examples, computer software, which when executed by a computer, causes the computer to carry out any of the methods discussed above is considered as an embodiment of the present disclosure. Similarly, embodiments of the disclosure are provided by a non-transitory, machine-readable storage medium which stores such computer software. It will also be apparent that numerous modifications and variations of the present disclosure are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims, the disclosure may be practised otherwise than as specifically described herein.

Claims

1. A system for monitoring and configuring a network, the system including:network equipment including a network switch providing one or more network ports for connecting an endpoint device to the network; anda controller in communication with the network switch, the controller having access to an endpoint device configuration data set including identifiers of endpoint devices and stored configuration settings associated with those endpoint devices;the network switch being configured to:detect a connection of an endpoint device to one of its network ports, and in response, send a configuration request to the controller,the configuration request including an identifier associated with the endpoint device and current configuration data relating to the configuration of the network port; andthe controller being configured to:receive the configuration request, andin response, to:access a record in the endpoint device configuration data set relating to the identifier provided in the configuration request,determine a discrepancy between the current configuration of the network equipment and at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set, andcommunicate a configuration update to the network switch, the configuration update including updated configuration settings corresponding to the at least one stored configuration setting associated with the identified endpoint device.

2. The system according to claim 1, wherein the controller is configured to determine whether a discrepancy is present between the current configuration of the network equipment and the at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set and to communicate the configuration update to the network switch responsive to whether a discrepancy is present.

3. The system according to claim 2, wherein in response to the controller determining the current configuration of the network equipment is the same as the at least one stored configuration setting, the controller is configured to inhibit communication of the configuration update to the network switch.

4. The system according to claim 2 or claim 3, wherein in response to the controller determining a discrepancy is present, the controller is configured to communicate the configuration update to the network switch.

5. The system according to any preceding claim, wherein the at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set includes a stored virtual local area network “VLAN” configuration setting.

6. The system according to any preceding claim, wherein the at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set includes a security configuration setting.

7. The system according to any preceding claim, wherein the controller has access to a default security configuration setting capable of being applied for any of the one or more network ports, and wherein the configuration update further includes the default security configuration setting.

8. The system according to claim 5, wherein the controller is configured to determine whether a discrepancy is present between a current virtual local area network “VLAN” associated with the network port and a stored VLAN associated with the identified endpoint device in the endpoint device configuration data set and to communicate the configuration update responsive to whether a discrepancy is present.

9. The system according to claim 8, wherein the current configuration data relating to the configuration of the network port comprises a VLAN ID and the stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set comprises another VLAN ID, and the controller is configured to determine whether a discrepancy is present between the VLAN ID and the another VLAN ID.

10. The system according to any preceding claim, wherein the endpoint device configuration data set comprises the at least one stored configuration setting associated with the identified endpoint device and a second stored configuration setting associated with the identified endpoint device, wherein the controller is configured to determine whether a discrepancy is present between the current configuration of the network equipment and the at least one stored configuration setting, and the controller is configured to communicate the configuration update to the network switch responsive to whether a discrepancy is present, wherein the configuration update includes updated configuration settings corresponding to the at least one stored configuration setting and the second stored configuration setting.

11. The system according to any one of claims 1-9, wherein the endpoint device configuration data set comprises the at least one stored configuration setting associated with the identified endpoint device and a second stored configuration setting associated with the identified endpoint device, wherein the controller is configured to:determine whether a discrepancy is present between the current configuration of the network equipment and the at least one stored configuration setting and communicate the configuration update including updated configuration settings corresponding to the at least one stored configuration setting responsive to whether a discrepancy is present for the at least one stored configuration setting; anddetermine whether a discrepancy is present between the current configuration of the network equipment and the second stored configuration setting and communicate a second configuration update including updated configuration settings corresponding to the second stored configuration setting responsive to whether a discrepancy is present for the second stored configuration setting.

12. The system according to claim 10 or claim 11, wherein the at least one stored configuration setting includes a stored VLAN configuration setting and the second stored configuration setting includes a security configuration setting, or wherein the at least one stored configuration setting includes the security configuration setting and the second stored configuration setting includes the stored VLAN configuration setting.

13. The system according to any preceding claim, wherein in response to a configuration request comprising a current VLAN and an identifier associated with an endpoint device, in which the identifier does not match an identifier in the endpoint device configuration data set, the controller is configured to determine whether a discrepancy is present between the current VLAN and a default VLAN, wherein in response to the controller determining a discrepancy is present, the controller is configured to communicate a configuration update comprising the default VLAN to the network switch, and wherein in response to the controller determining that the current VLAN matches the default VLAN, the controller is configured to inhibit communication of the configuration update to the network switch.

14. The system according to claim 13 when dependent on claim 7, wherein in response to the controller determining a discrepancy is present between the current VLAN and the default VLAN, the controller is configured to communicate the configuration update to the network switch, in which the configuration update comprises the default VLAN and the default security configuration setting.

15. The system according to any preceding claim, wherein the network switch is configured to update the configuration of the network port responsive to the configuration update.

16. A controller apparatus for monitoring and configuring network switches on a network, the controller apparatus configured to:communicate with one or more network switches;access an endpoint device configuration data set including identifiers of endpoint devices and stored configuration settings associated with those endpoint devices;receive a configuration request from a network switch of the one or more network switches, the configuration request including an identifier associated with an endpoint device connected to a network port of the network switch and current configuration data relating to the configuration of the network port;and in response to the configuration request, the controller apparatus is configured to:access a record in the endpoint device configuration data set relating to the identifier provided in the configuration request,determine a discrepancy between the current configuration of the network equipment and at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set, andcommunicate a configuration update to the network switch, the configuration update including updated configuration settings corresponding to the at least one stored configuration setting associated with the identified endpoint device.

17. A computer-implemented method comprising:detecting, by a network switch, a connection of an endpoint device to a network port of the network switch;communicating, by the network switch, a configuration request to a controller in communication with the network switch in response to detecting the connection of the endpoint device, the configuration request including an identifier associated with the endpoint device and current configuration data relating to the configuration of the network port;receiving, by the controller, the configuration request;accessing, by the controller, a record in an endpoint device configuration data set, the endpoint device configuration data set including identifiers of endpoint devices and stored configuration settings associated with those endpoint devices, the record relating to the identifier provided in the configuration request;determining, by the controller, a discrepancy between the current configuration of the network equipment and at least one stored configuration setting associated with the identified endpoint device in the endpoint device configuration data set, andcommunicating, by the controller, a configuration update to the network switch, the configuration update including updated configuration settings corresponding to the at least one stored configuration setting associated with the identified endpoint device.

18. Computer software, which when executed by a system comprising a controller and network equipment comprising a network switch, causes the system to carry out the method of claim 17.31

Images