Automatic device assignment through programmable device discovery for policy based network management

#The invention generally relates to policy based network management and more particularly to an automatic device assignment through a programmable device discovery for policy based network management.

#Networks and distributed processing systems are of critical importance in business, government and other organizations. The growing trend is towards larger and more complex networks, which support more applications and more users. As these networks grow in size and complexity, the management and control of these networks becomes more difficult.

#Current techniques for network management allow for the automatic identification of nodes in a network, the retrieval of information or statistics from each node, and setting or initializing one or more parameters at a node. More recently, policy based network management systems provide a more sophisticated control technique that allows for control policies to be distributed and used for controlling the operation of various network nodes or devices. The COPS (Common Open Policy Service) Protocol, RFC2748, January, 2000 even describes a common protocol to be used to exchange policy information between a policy server and its clients (e.g., devices).

#The foregoing and a better understanding of the present invention will become apparent from the following detailed description of exemplary embodiments and the claims when read in connection with the accompanying drawings, all forming a part of the disclosure of this invention. While the foregoing and following written and illustrated disclosure focuses on disclosing example embodiments of the invention, it should be clearly understood that the same is by way of illustration and example only and is not limited thereto. The spirit and scope of the present invention is limited only by the terms of the appended claims.

#The following represents brief descriptions of the drawings, wherein:

#FIG. 1 is a block diagram of a network according to an example embodiment.

#A technique for automatically assigning devices to device proxies in a policy based network management system is described. Each device proxy registers a filter (or set of filters) with a device discovery. The filter may identify the characteristics of devices it can (or would like to) policy manage. The device discovery then obtains device specific information from devices to identify devices in the network that match the filters. The device discovery may obtain the device specific information using a communications protocol specified by the filter. The device discovery notifies each device proxy of which devices match the proxy's filter. Each device proxy updates its list of devices that it can policy manage based on the notification from the device discovery. Control policies are distributed from a policy server to each of the device proxies. Each device proxy then sends to the devices specified within the policy (e.g., this may include the devices which matched the filter for the proxy, or some other devices).

#Referring to the Figures in which like numerals indicate like elements, FIG. 1 is a block diagram illustrating a network 100 according to an example embodiment. A policy console 110 is provided for creating policies. Typically, these policies may be created by an administrator, but could be automatically created as well. These policies can include a wide variety of control policies (or business policies) for controlling the operation of a wide variety of devices (e.g., switches, routers, network interface controllers or NICs, and other network devices). According to an example control policy, all packets (or traffic) received from a specific range of source Internet Protocol (IP) addresses will be blocked (will not be forwarded) when received between the hours of 9am to 5pm. This is just a very simple policy, but much more elaborate or complicated control policies are commonly used to control the operation of network devices. Other types of example control policies include, firewall or security policies, Virtual Private Network (VPN) policies, priority policies (e.g., where certain traffic is given priority over other traffic), quality of service (QoS) policies, Internet Protocol (IP) security policies, etc.

#A policy server 112 receives policies from the policy console 110. Policy server 112 then selectively distributes (or deploys) various policies to one or more device proxies 116. Device proxies 116A, 116B, . . . and 116Z are shown in FIG. 1. However, there may be any number of device proxies 116. Each proxy 116 may be a software program running on a computer or server, and generally operates as an interface between the policy server 112 and one or more devices 120 to be controlled using various control policies. Thus, each device proxy 116 can policy manage one or more devices. Devices 116 can be, for example, a router, a switch, a NIC, or other type of network device.