Enforcement of network device configuration policies within a computing environment

摘要

A network management system is described for assuring that a network device complies with a device-specific configuration policy. One example of the network management system contains one or more business rules that describe a business policy regarding a computer network in a network-independent form. In general, the business rules refer to high-level business requirements and not to device-specific configuration information. The network management system uses the business rule to determine which business policies are currently in force. In addition, the network management system contains one or more network design rules that describe relationship between the business policy and one or more device-specific configuration policies. The network management server uses the network design rules to determine whether to deploy a device-specific configuration policies. In this manner, an administrator or other user may create high-level business rules without regard to particular network devices or topologies, yet device-specific configuration polices are deployed to the network devices to assure compliance even if the network management system is bypassed.

主权项

1. A computer-implemented method comprising:
invoking a rules engine of a network management system to evaluate a business rule to determine whether to enforce a device-independent business policy regarding a computer network having a plurality of network devices; when the device-independent business policy is to be enforced, invoking the rules engine of a network system to evaluate a network design rule that relates the business policy to a device-specific configuration policy; and deploying the device-specific configuration policy to a set of one or more of the network devices of the computer network, wherein the device-specific configuration policy controls application of configuration change requests to configuration profiles of the network devices after the configuration change requests are received via interfaces of the respective network devices.