JP2000099428A - Method for collecting information between networks and network managing device to be used for the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method for collecting information on one network on the other network without changing any security condition (network policy) and a network managing device to be used for the same. SOLUTION: A network managing device 37 acquires and stores the equipment or network information of a terminal group 31 to be managed through a managing protocol SNMP, this is assembled into HTTP protocol in order to pass it through a fire wall 38, substitutively transferred to an http-Proxy server 39 and further transferred/stored through an internet 10 into a Web (http) server 29 through an HTTP protocol, and this is acquired with the HTTP protocol by the network managing device 27 and inversely transformed to a managing protocol SNMP so that the equipment or network information of the terminal group 31 to be managed can be provided.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a method for collecting information between network management devices of a plurality of networks connected to a public network with a predetermined network policy, and a network management device used for the method.

[0002]

2. Description of the Related Art FIG. 1 shows an example of a system using a conventional method for collecting information between networks, in which 1 is a public network used by an unspecified number of people, and 2 is a network management device. The target range (base) of the network to be managed is 3 and the target range (base) of the network managed by another network management device.

[0003] The site 2 collects management information of the managed terminal group 21 using a managed terminal group 21 composed of a plurality of managed terminals, Ethernets 22 and 23 connecting each device in the site, and a management protocol. Network management device 24,
It comprises a firewall 25 capable of defining security conditions (network policy) such as packet communication permission prohibition and the like for each segment and port, and an information storage server 26 for storing information from the public network 1 and the like.

[0007] The site 3 collects management information of the managed terminal group 31 using a managed terminal group 31 composed of a plurality of managed terminals, Ethernets 32 and 33 connecting each device in the site, and a management protocol. Network management device 3
4. Firewall 35, Ethernet 32, 3 capable of defining security conditions (network policy) such as packet communication permission prohibition for each segment and port
3 and a protocol relay server 36 for relaying the protocol between the device on the public network 1 and the public network 1.

FIG. 2 shows whether or not protocol communication is possible between segments set by the security conditions of the firewalls 25 and 35. The items on the horizontal axis indicate segments for transmitting (transmitting) packets, and the items on the vertical axis indicate packets. This represents a segment to be received (received). The symbol “記号” in the figure permits communication of all protocols between the outgoing and incoming segments, and the symbol “×” prohibits communication of all protocols. In addition, “Δ” uses a protocol (HT
TP, SMTP, NNTP, etc.), and relays the internal network to the public network 1.

More specifically, a packet transmitted from the public network 1 permits communication of all protocols when the receiving side is the public network 1 and the packet transmitted from the Ethernet 2
In the case of Ethernet 2 and 32, communication of all protocols is prohibited, and in the case of Ethernet 23 and 33, only packets that require a specific relay are communicated.

The packet transmitted from the Ethernet 22 permits communication of all protocols when the receiving side is the Ethernet 22 or 23, and prohibits communication of all protocols for other segments. The packet transmitted from the Ethernet 23 is transmitted to the Ethernet 22 or 2 on the receiving side.
In the case of 3, the communication of all the protocols is permitted, in the case of the Ethernet 32, the communication of all the protocols is prohibited, and only the packets requiring a specific relay are communicated to the public network 1 and the Ethernet 33.

The packet transmitted from the Ethernet 32 permits communication of all protocols when the receiving side is the Ethernet 32 or 33, and prohibits communication of all protocols for other segments. The packet transmitted from the Ethernet 33 is transmitted to the Ethernet 32, 3
In the case of 3, the communication of all the protocols is permitted, in the case of the Ethernet 22, the communication of all the protocols is prohibited, and only the packets requiring a specific relay are communicated to the public network 1 and the Ethernet 23.

[0009]

In such a conventional method, network information is collected and managed from a network management device 24 via a public network 1 in a group of managed terminals 31 and an Ethernet 32 in a site 3. Is required, the protocol must be able to communicate directly. Therefore, it is necessary to change the security conditions (network policy) between the Ethernets 22 and 32 and the public network 1 in the firewalls 25 and 35 from prohibition of all protocol communication to communication permission, which causes a new security hole. there were.

[0010] An object of the present invention is to provide a method of collecting information between networks that allows information about one network to be collected by another network without changing security conditions (network policies) defined by a firewall or the like. An object of the present invention is to provide a network management device used for the above.

[0011]

According to the present invention, there is provided a method for collecting information between network management devices of a plurality of networks connected to a public network with a predetermined network policy. The apparatus is characterized in that information about the own network is converted into a protocol that can be transferred outside the own network within the scope of the network policy, and transferred to a network management apparatus of another network via the public network.

[0012] According to the above configuration, information on one network is converted into a protocol that can be transferred outside the own network within the scope of the network policy, and this is transferred to the network management device of another network via the public network. Therefore, management information of an arbitrary network can be collected without changing conditions defined by a firewall or the like.

At this time, HTT is used as the protocol to be converted.
The P protocol can be used.

[0014] Further, according to such a method, the management data extracting means for extracting information to be transferred to the network management device of another network, the scheduling means for instructing the interval of information extraction, and the management data extracting means. Transfer protocol processing means for converting information into a protocol that can be transferred outside the own network and reverse conversion of the protocol of information received from another network; and assembling and disassembling packets between the transfer protocol processing unit and the interface. This can be realized by using a network management device having an interface control unit for performing the operation.

[0015]

FIG. 3 shows an example of an embodiment of a method for collecting information between networks according to the present invention. In the figure, the same components as those of the conventional example are denoted by the same reference numerals. That is, 10 is the Internet, which is a network used by an unspecified majority, 20 is the target range (base) of the network managed by one network management device, 3
0 is a target range (base) of a network managed by another network management device.

The site 20 is composed of a group of managed terminals 21, Ethernets 22 and 23, a network management device 27, a firewall 28, and a Web (http) server 29. In addition, the base 30 includes the managed terminal group 3
1, Ethernet 32, 33, network management device 3
7, a firewall 38, and an http-Proxy server 39.

The firewall 28 prevents unauthorized connection from the Internet 10 to the base 20, and secures the security of the base. The firewall 38 prevents unauthorized connection from the Internet 10 to the base 30, and secures the security of the base.

FIG. 4 shows whether or not a protocol can be communicated between the Internet and each Ethernet set according to the security conditions of the firewalls 28 and 38. The item on the horizontal axis is a segment for transmitting (transmitting) packets, and the item on the vertical axis. Represents a segment for receiving (arriving) a packet. The symbol “記号” in the figure permits communication of all protocols between the outgoing and incoming segments, and the symbol “×” prohibits communication of all protocols. “Δ” is HTT
Only allow communication of the P protocol, and the Internet 10
It is possible to receive services such as the above Web reference.

More specifically, a packet transmitted from the Internet 10 permits communication of all protocols when the receiving side is the Internet 10,
In the case of Ethernet 2 and 32, communication of all protocols is prohibited, and in the case of Ethernet 23 and 33, only the HTTP protocol is communicated.

The packet transmitted from the Ethernet 22 permits communication of all protocols when the receiving side is the Ethernet 22 or 23, and prohibits communication of all protocols for other segments. The packet transmitted from the Ethernet 23 is transmitted to the Ethernet 22 or 2 on the receiving side.
In the case of 3, the communication of all protocols is permitted, in the case of the Ethernet 32, the communication of all protocols is prohibited, and only the HTTP protocol is communicated with the Internet 10 and the Ethernet 33.

Packets transmitted from the Ethernet 32 permit communication of all protocols when the receiving side is the Ethernet 32 or 33, and prohibit communication of all protocols for other segments. The packet transmitted from the Ethernet 33 is transmitted to the Ethernet 32, 3
In the case of 3, communication of all protocols is permitted, in the case of Ethernet 22, communication of all protocols is prohibited, and only the HTTP protocol is communicated with the Internet 10 and Ethernet 23.

The network management apparatus 37 has a function of collecting device information and network management information of the group of managed terminals 31 installed at the base 30 by a management protocol SNMP, and transferring the information by using an HTTP protocol. . The network management device 27 collects the device information and the network management information of the managed terminal group 21 installed at the base 20 by the management protocol SNMP, and also collects the device information and the network collected by the network management device 37 by using the HTTP protocol. Has the function of collecting and displaying information.

The Web (http) server 29 is capable of storing information collected by the network management device 37, and its connection is based on the HTTP protocol. ht
The device on the Ethernet 32 is the Internet 10 or the Web (http) server 2 as the tp-Proxy server 39.
9 has a function of relaying a packet of the HTTP protocol in order to connect to the H.9.

FIG. 5 shows a sequence in which the network management device 27 obtains information about the managed terminal group 31 via the Internet 10.

The network management device 37 constantly acquires devices and network information of the managed terminal group 31 under its own management by the management protocol SNMP, and accumulates and stores the information in its own device. The network management device 37 assembles the stored and stored information into an HTTP protocol in order to communicate with the firewall 38,
Proxy transfer to the proxy server 39.

H when information is received by the HTTP protocol
The Http-Proxy server 39 transfers the information to the Web (http) server 29, which is the storage destination of the information, via the Internet 10 using the HTTP protocol. Web
(Http) The server 29 accumulates and stores the information in a predetermined place.

The network management device 27 connects to the Web (http) server 29 using the HTTP protocol, acquires information from a predetermined location on the server 29, and reversely converts the information into the management protocol SNMP,
The device and network information of the managed terminal group 31 can be obtained.

FIG. 6 shows a detailed configuration of the network management device. The network management device is roughly divided into existing NMSs (Network M).
management system) 40 and N
It comprises an MS cooperation function unit 50 and is connected to a network (Ethernet) via an external interface.

The existing NMS function section 40 is a section for executing a conventionally implemented network management function, and includes a network information display section 41, a network management basic section 42, a management protocol processing section 43, an interface control section. 44.

The network information display section 41 has a function of displaying information of the network management basic section 42 on a screen. The network management basic unit 42 has a function of monitoring the configuration and status of devices and the like on the network. The management protocol processing unit 43 has a function of translating a request for acquiring information on devices on the network from the network management basic unit 42 into a management protocol, or transmitting a return value accompanying the acquisition request to the network management basic unit 42. The interface control unit 44 has a function of assembling and disassembling into packets between the management protocol processing unit 43 and the interface.

The NMS coordination function unit 50 indicates a part for executing a network management function according to the present invention, and includes a scheduling unit 51 and a management data extraction unit 5.
2. It is composed of a transfer protocol processing unit 53 and an interface control unit 54.

The scheduling unit 51 has a function of instructing the management data extracting unit 52 on the operation interval. The management data extraction unit 52 is a network management basic unit 4
2 has a function of extracting information to be transferred to another network management device, transmitting the information to the transfer protocol processing unit 53, and transmitting information of the device and the like received from the transfer protocol processing unit 53 to the network management basic unit 42. . The transfer protocol processing unit 53 converts the information transmitted from the management data delivery unit 52 into a protocol that can be transferred outside the own network, transmits the protocol to the interface control unit 54, and transmits the information to another network received from the interface control unit 54. It has the function of reversely converting the transfer protocol of information (management data) from the server. The interface control unit 54 has a function of assembling and disassembling into packets between the transfer protocol processing unit 53 and the interface.

[0033]

As described above, according to the present invention,
It is possible to collect information on an arbitrary network as if it were a network under self-management, without reducing security in each network.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram showing an example of a conventional information collection method between networks.

FIG. 2 is a diagram showing a network policy in a firewall in FIG. 1;

FIG. 3 is a system configuration diagram showing an example of an embodiment of a method for collecting information between networks according to the present invention;

FIG. 4 is a diagram showing a network policy in a firewall in FIG. 3;

FIG. 5 is a diagram showing a sequence when the network management device 27 acquires information about the managed terminal group 31 via the Internet 10.

FIG. 6 is a functional block diagram showing a detailed configuration of a network management device.

[Description of Signs] 10: Internet, 20, 30: Network target range (base), 21, 31: Managed terminal group, 22, 2
3, 32, 33: Ethernet, 27, 37: Network management device, 28, 38: Firewall, 29:
Web (http) server, 39: http-Prox
y server, 40: existing NMS function units 40, 41: network information display unit, 42: network management basic unit, 4
3: management protocol processing unit, 44, 54: interface control unit, 50: NMS cooperation function unit, 51: scheduling unit, 52: management data extraction unit, 53: transfer protocol processing unit.

──────────────────────────────────────────────────の Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 12/66 H04L 11/20 B 29/06 13/00 305C H04M 3/00 F term (Reference) 5B089 GA14 GA19 GA21 GB01 HA01 HB05 HB06 JA21 KA17 KB13 KC27 KF05 5K030 HB06 HC01 HC14 HD08 JA10 LB15 MC07 MC09 5K033 BA08 BA11 BA13 CB02 CB08 CB14 DA01 DA06 DB20 EA07 5K034 AA13 AA14 EE09 HH61 HQ01 BB02

Claims (3)

[Claims] 1. A method for collecting information between network management devices of a plurality of networks connected to a public network according to a predetermined network policy, comprising the steps of: A method for collecting information between networks, wherein the information is converted into a protocol which can be transferred outside and transferred to a network management device of another network via a public network. 2. The method for collecting information between networks according to claim 1, wherein an HTTP protocol is used as a protocol to be converted. 3. A network management device used in the method for collecting information between networks according to claim 1 or 2, wherein management data extracting means for extracting information to be transferred to a network management device on another network. Scheduling means for instructing an information extraction interval, and transfer protocol processing for converting the information extracted by the management data extracting means into a protocol that can be transferred outside the own network, and reversely converting the protocol of information received from another network. A network management apparatus comprising: means; and an interface control means for assembling and disassembling a packet between a transfer protocol processing unit and an interface.