Method and apparatus for defining and enforcing policies for configuration management in communications networks

A method for enforcing policies that apply to a device in a network, the method comprising the steps of:

• triggering an enforcement;
• determining whether any conflicts exist among policies that are applied to the network, the step of determining whether any conflicts exist including the steps of:
• determining at least one group of which the device is a member;
• determining applicable policies for the at least one group, the applicable policies each having a configuration record that includes attributes associated with attribute values;
• and
• determining whether a first applicable policy of the applicable policies has a first configuration record that includes a first value associated with a first attribute, and a second applicable policy of the applicable policies has a second configuration record that includes a second value associated with the first attribute, a conflict existing when the second value is different from the first value;
• when the step of determining determines that a conflict exists, resolving the conflict.

An apparatus for managing configurations of network devices connected in a network comprising:

• a database that includes an association of a configuration record with at least one network device in a network group, the database including:
• an association of a first policy having a first ordering index with the network group;
• and
• an association of a second policy having a second ordering index with the network group;
• and
• means for loading, over a network, a configuration described by the configuration record into each network device in the network group, the means for loading including means for loading a first configuration defined by the first policy and a second configuration defined by the second policy in an order defined by the first ordering index and the second ordering index.

An apparatus for enforcing policies that apply to a device in a network, the apparatus comprising:

• a trigger;
• an inference engine that determines whether any conflicts exist among policies that are applied to the network and resolves the conflicts that exist, the inference engine including:
• means for determining at least one group of which the device is a member;
• means for determining applicable policies for the at least one group, the applicable policies each having a configuration record that includes attributes associated with attribute values;
• and
• means for determining whether a first applicable policy of the applicable policies has a first configuration record that includes a first value associated with a first attribute, and a second applicable policy of the applicable policies has a second configuration record that includes a second value associated with the first attribute, wherein a conflict exists if the second value is different from the first value.