Method and apparatus for network wide policy-based analysis of configurations of devices

In a network having a plurality of network devices, a method, using an analysis platform, for analyzing a proposed change to a configuration file of one of said network devices, the method comprising the steps of:

• receiving a network policy pertaining to said network;
• receiving a network configuration model for said network, wherein said network configuration model is based on a topology of said network and configuration data pertaining to at least a portion of said network devices;
• receiving said proposed change to said configuration file;
• creating an updated network configuration model based on said proposed change;
• and
• analyzing said updated network configuration model in accordance with said network policy to determine the existence of a violation of said network policy.

A computer program, performed by a computer, for analyzing a network having a plurality of network devices, the computer program comprising:

• instructions for parsing a network policy file containing a network policy pertaining to said network;
• instructions for parsing a network topology file containing a topology of said network devices in said network;
• instructions for parsing configuration files of selected ones of said network devices to obtain configuration data for said selected ones of said network devices, wherein said instructions for parsing said network policy file, said instructions for parsing said network topology file and said instructions for parsing said configuration files cooperate to create a network configuration model for said network based on said topology and said configuration data;
• instructions for generating a query for analyzing said network;
• and
• instructions for using said query to determine the existence of a violation of said network policy.

A computer program for processing data, comprising:

• instructions for receiving a network policy pertaining to a network;
• instructions for receiving a topology of a plurality of network devices in said network;
• instructions for receiving configuration data from at least a portion of said plurality of network devices;
• instructions for creating a network configuration model for said network based on said topology and said configuration data received;
• instructions for analyzing said network configuration model in accordance with said network policy to determine the existence of a violation of said network policy;
• and
• instructions for generating a report specifying said violation if said violation exists.