Live network sandboxing on a centralized management system

Patent metadata

Field	Value
Publication number	US-11088915-B1
Application number	US-202016745897-A
Country	US
Kind code	B1
Filing date	Jan 17, 2020
Priority date	Jan 17, 2020
Publication date	Aug 10, 2021
Grant date	Aug 10, 2021

Abstract

Systems, methods, and computer-readable media for predicting policy changes in a network environment through a data serialization language. Running configurations of one or more network devices in a network environment can be collected. Further, a master device template of a new policy for the network environment can be generated through a data serialization language based on the running configurations of the one or more network devices. The master device template can include a directory-based tree structure of a simulated implementation of the new policy in the network environment. Policy changes in the network environment for the new policy can be predicted before implementing the new policy in the network environment based on simulated packet traversal through the directory-based tree structure of the simulated implementation of the policy in the network environment.

First claim

What is claimed is:

1. A method comprising:
collecting information associated with a new policy to be implemented in a network environment;
collecting running configurations of one or more network devices in the network environment;
collecting information associated with at least one current policy of the network environment;
generating a master device template of the new policy for the network environment through a data serialization language based on the information associated with the new policy and the running configurations of the one or more network devices,
wherein the master device template includes a directory-based tree structure of a simulated implementation of the new policy in the network environment based on the information associated with the at least one current policy of the network environment and the information associated with the new policy;

predicting policy changes associated with the at least one current policy and the new policy from deploying the new policy based on simulated packet traversal through the directory-based tree structure of the master device template; and
selectively deploying the new policy into the network environment based on the predicted policy changes.

2. The method of claim 1 , further comprising:
identifying policy specific configurations of the one or more network devices from the running configurations of the one or more network devices; and
generating the directory-based tree structure of the master device template of the new policy based on the policy specific configurations of the one or more network devices.

3. The method of claim 1 , further comprising comparing a configuration of the master device template to the running configurations of the one or more network devices in the network environment to verify one or more accuracies of the master device template.

4. The method of claim 1 , wherein the data serialization language is YAML.

5. The method of claim 4 , further comprising:
generating a YAML file for each of a plurality of directories in the directory-based tree structure as part of generating the directory-based tree structure;
consolidating the YAML file for each of the plurality of directories across the directory-based tree structure to create a consolidated YAML file; and
generating the master device template from the consolidated YAML file.

6. The method of claim 5 , wherein the YAML file for each of the plurality of directories in the directory-based tree structure corresponds to a specific policy component of the new policy.

7. The method of claim 1 , further comprising:
generating directories for the new policy based on policy components of the new policy;
categorizing the directories according to characteristics of the policy components of the new policy corresponding to the directories; and
forming the directory-based tree structure according to the characteristics of the policy components of the new policy.

8. The method of claim 7 , wherein the characteristics of the policy components include either or both physical and virtual locations of the policy components in the network environment.

9. The method of claim 7 , wherein the characteristics of the policy components include plane implementation in either a control plane or a data plane of the policy components in the network environment.

10. The method of claim 7 , further comprising:
identifying policy specific configurations of the one or more network devices from the running configurations of the one or more network devices; and
generating a YAML file for each of the directories that have an equivalent policy specific configuration of the policy specific configurations of the one or more network devices as part of generating the directory-based tree structure of the master device template of the new policy based on the policy specific configurations of the one or more network devices.

11. The method of claim 1 , wherein the simulated packet traversal is a known packet traversal through the directory-based tree structure of the simulated implementation of the policy in the network environment.

12. The method of claim 11 , further comprising:
applying one or more data serialization language files corresponding to directories in the directory-based tree structure to the simulated packet traversal in an order of the directories of the directory-based tree structure according to the known packet traversal through the directory-based tree structure; and
predicting the policy changes in the network environment based on one or more effects of application of the one or more data serialization files corresponding to the directories in the directory-based tree structure according to the order of the directories of the directory-based tree structure applied according to the known packet traversal.

13. The method of claim 12 , wherein the effects are predicted based on the one or more data serialization files applied to one or more simulated packets traversing at least a portion of the directory-based tree structure according to the known packet traversal.

14. The method of claim 1 , further comprising selectively deploying the new policy into the network environment based on the policy changes predicted for the new policy.

15. A system comprising:
one or more processors; and
at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
collecting information associated with a new policy to be implemented in a network environment;
collecting running configurations of one or more network devices in a network environment;
collecting information associated with at least one current policy of the network environment;
generating a master device template of the new policy for the network environment through YAML based on the information associated with the new policy and the running configurations of the one or more network devices,
wherein the master device template includes a directory-based tree structure of a simulated implementation of the new policy in the network environment based on the information associated with the at least one current policy of the network environment and the information associated with the new policy;

predicting policy changes associated with the at least one current policy and the new policy from deploying the new policy based on simulated packet traversal through the directory-based tree structure of the master device template; and
selectively deploying the new policy into the network environment based on the predicted policy changes.

16. The system of claim 15 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising comparing a configuration of the master device template to the running configurations of the one or more network devices in the network environment to verify one or more accuracies of the master device template.

17. The system of claim 15 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising:
generating a YAML file for each directory in the directory-based tree structure as part of generating the directory-based tree structure;
consolidating the YAML file for each directory across the directory-based tree structure to create a consolidated YAML file; and
generating the master device template from the consolidated YAML file.

18. The sy

Assignees

• Cisco Tech Inc

Inventors

• Malhotra Neha
• Somaskanthan Vandhana
• Channapatna Renuka Mohan
• Prabhu Vinay
• Parekh Jigar Dinesh
• Fu Huayu

Classifications

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L41/147

  for predicting network behaviour · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/145 Primary

  involving simulating, designing, planning or modelling of a network · CPC title