Juniper Networks, Inc.

Robert P Enns

Philip Austin Shafer

Greg Sidebottom

Simon John Gerraty

Reid Evan Wilson

Paulo Lima

William P Welch

Craig A Bardenheuer

Mark E Trostler

Michael Soren Jacobsen

Pallavi Mahajan

Dogu Narin

Daniel Kharitonov

M Richard Salaiz

Philip A Schafer

Dean Sheffield

Daniel Khartitonov

A network management system is described for assuring that a network device complies with a device-specific configuration policy. One example of the network management system contains one or more business rules that describe a business policy regarding a computer network in a network-independent form. In general, the business rules refer to high-level business requirements and not to device-specific configuration information. The network management system uses the business rule to determine which business policies are currently in force. In addition, the network management system contains one or more network design rules that describe relationship between the business policy and one or more device-specific configuration policies. The network management server uses the network design rules to determine whether to deploy a device-specific configuration policies. In this manner, an administrator or other user may create high-level business rules without regard to particular network devices or topologies, yet device-specific configuration polices are deployed to the network devices to assure compliance even if the network management system is bypassed.

Enforcement of network device configuration policies within a computing environment

A network device may include logic configured to invoke proactive programs based on the expiration of a long time period within the network device, wherein the proactive programs collect data relating to operations of the network device, invoke reactive programs based on the detection of at least one of an event or expiration of a short time period, wherein the reactive programs collect, correlate and analyze data relating to the detected event or expiration of a short time period, determine a corrective action based on collected and analyzed data, and perform the determined corrective action within the network device.

Embedded reactive and proactive intelligence

Techniques are described for application of implementation-specific configuration policies within a network device. For example, a device, such as a router, may comprise memory to store operational configuration data and candidate configuration data. The device further includes a control unit to apply changes to the candidate configuration data based on input from a client, and apply an implementation-specific configuration policy to a copy of the changed candidate configuration data. Based on a result of applying the implementation-specific configuration policy, the device selectively commits the changes made to the candidate configuration to the operational configuration. In the event an error occurs while applying the implementation-specific configuration policy, the device does not commit the changes to the operational configuration. In this manner, the device does not allow changes that violate the implementation-specific configuration policy to be committed to the operational configuration, thereby detecting misconfiguration that may otherwise be syntactically and semantically correct.

Automatic application of implementation-specific configuration policies

A service provider network includes an automated support module that receives stream of network packets from subscribers and separates this streams into packet flows for analysis. The automated support module may be an intermediate device that examines each packet flow to detect subscriber characteristics for each subscriber. The automated support module may apply a set of analysis rules to the detected characteristics to aid diagnosis of reported or potential network errors.

Analyzing network traffic to diagnose subscriber network errors

Processing of numeric addresses is facilitated by using a user interface, rather than system modules, to handle name resolution. Processing the addresses at the user interface level avoids delays and packet blocking problems associated with using system modules to perform the task. Relieving the system modules from the responsibility of processing numeric addresses allows them to process other requests, improving overall system efficiency.

Processing numeric addresses in a network router

Techniques for controlling access to resources within a device are described. A device is described, for example, that includes a computer-readable medium and a management interface. The computer-readable medium stores configuration data and authorization data. The authorization data defines an access control attribute and an associated regular expression specifying a textual pattern. The management interface receives a text-based command to access the configuration data of the device, evaluates the command using the regular expression, and controls access to the configuration data based on the evaluation.

Network device management interface having fine-grain access control using regular expressions

Management interface having fine-grain access control using regular expressions

Techniques for comparing sets of configuration information for data forwarding devices, such as routers, are disclosed. Scoping may be used to limit comparisons to particular hierarchical levels and/or categories of sets of configuration information. Different users may have different permissions regarding viewing, or editing different parts of configuration information.

Comparing configuration information for a data forwarding device

An entity, such as a human user or automated program or script, can request an exclusive lock on a router configuration database that prevents other entities from modifying the configuration database until the lock is released. The lock is granted only if no other entity has a lock and the configuration database has not been modified since the last time it was committed. Misconfiguration of the router is thereby prevented.

Configuring a network router

Techniques are described for application of implementation-specific configuration policies within a network device to generate configuration data. For example, a device, such as a router, may comprise memory to store operational configuration data and candidate configuration data. The device further includes a control unit to apply an implementation-specific configuration policy to alter changes to the candidate configuration data, and commit the altered candidate configuration data to the operational configuration data. In applying the implementation-specific configuration policy, the control unit may insert additional configuration data or replace portions of the candidate configuration data with additional configuration data. In this manner, the device may detect misconfiguration and make changes to the candidate configuration data, thereby performing proactive error correction.

Automatic generation of configuration data using implementation-specific configuration policies

Techniques are described that configure a router in a configuration mode specified by a client. For example, a client may request to configure the router in a private configuration mode. In response to the command, a management module creates a private database. A client may edit the configuration data of the private database. The client may edit the private database without interference from other clients that may also be editing configuration data of the router. Management server module updates the committed database with edited private database, and the router begins to operate in accordance with the updated configuration data.

Private configuration of network devices

A reverse-search function may accept user input and search back through previously executed and stored data forwarding device control instructions for a data forwarding device control instruction, at least a part of which matches a search string input by the user. The matching data forwarding device control instruction may be retrieved and rendered. A reverse-expand function may accept user input, and search back through previously executed and stored data forwarding device control instructions for a data forwarding device control instruction having an word or parameter, at least a part of which matches a search string input by the user. The first matching word or parameter may be retrieved and rendered.

Growing community of inventors

Los Gatos, CA, United States of America

Robert P Enns