Enforcement of network device configuration policies within a computing environment

A network management system comprising:

• a set of business rules that describe device-independent business policies, wherein the business rules are written in a format that conforms to a business rule definition language and are independent of the types of network devices within a computer network;
• a set of network design rules that relate the device-independent business policies to device-specific configuration policies, wherein the network design rules conform to a network design language used to describe the network devices and topology of the network;
• and
• a rules engine that evaluates the business rules and the network design rules to select one or more of the device-specific configuration policies for deployment;
• and
• a deployment engine that deploys the device-specific configuration policies selected by the rules engine to one or more of the network devices, wherein each of the selected device-specific configuration policies control application of configuration change requests to configuration profiles of the network devices after the configuration change requests are received via interfaces of the network devices.

A system comprising:

• a network management system comprising:
• (i):
• a set of business rules to contain a business rule that describes a business policy regarding a computer network,
• (ii):
• a set of network design rules to contain a network design rule that describes a relationship between the business policy and a device-specific configuration policy,
• (iii):
• a rules engine to determines whether a business policy is currently in force by evaluating the business rule and determines whether to deploy a device-specific configuration policy by evaluating the network design rule, and
• (iv):
• a deployment engine to deploy the device-specific configuration policy;
• and
• a network device comprising:
• (i):
• a configuration database to store a configuration profile for the network device;
• (ii):
• an interface to receive configuration change requests that request modifications to the configuration profile;
• and
• (iii):
• a configuration policy enforcement module that manages the configuration profile and applies the device-specific configuration policy to control application of the received configuration change requests to the configuration profile of the network devices to ensure the configuration profile to conforms to the device-specific configuration policy when the device-specific configuration policy is deployed by the network management system.

A method comprising:

• storing, with a network device, data defining a configuration profile that specifies current values of configuration options for the network device;
• receiving, with the network device, a device-specific configuration policy from a network management system;
• receiving, with an interface of the network device, configuration change requests that request modifications to the configuration profile;
• and
• applying the device-specific configuration policy to control application of the received configuration change requests to the configuration profile of the network devices to ensure the configuration profile conforms to the device-specific configuration policy.

A network device managed by a network management system, the network device comprising:

• a configuration database to store a device-specific configuration profile for the network device, wherein the configuration profile specifies current values of configuration options for the network device;
• an interface that receives configuration change requests that request modifications to the configuration profile;
• and
• a control unit comprising a configuration policy enforcement module that applies the device-specific configuration policy to control application of the received configuration change requests to the configuration profile of the network devices so as to ensure the configuration profile conforms to the device-specific configuration policy.