JP7540823B2 - NETWORK MANAGEMENT SYSTEM, VPN DEVICE, NETWORK MANAGEMENT METHOD, AND NETWORK MANAGEMENT PROGRAM - Google Patents

Description

The present invention relates to a network management system, a VPN device, a network management method, and a network management program. In particular, the present invention relates to a network management system, a VPN device, a network management method, and a network management program that manage terminals connected to a VPN device.

As disclosed in Patent Documents 1 and 2, there is a technology known as a VPN (Virtual Private Network) that manages multiple private networks located in remote locations as a single virtual private network.

JP 2006-262131 A WO 2007/141840

The following analysis has been made from the perspective of the present invention. The disclosures of the above-mentioned prior art documents are incorporated herein by reference.

Conventionally, the IP address of a terminal is changed even when the terminal moves between remote locations. Therefore, when applying an IP address-based security policy, the security policy must be dynamically updated, resulting in high network management costs. In addition, there is also the problem that communication between terminals is often interrupted when the address is changed.

Patent Document 1 discloses a technology that enables simultaneous connection to different private networks. Patent Document 2 discloses a technology that uses a mobile router or the like. However, it is difficult to implement either technology in all low-function devices (such as small IoT (Internet of Things) devices).

The present invention aims to provide a technology that enables terminals to move between remote locations without interrupting communication between terminals, while reducing network management costs.

According to a first aspect of the present invention,
A plurality of VPN (Virtual Private Network) devices are included;
Each VPN device:
a local terminal management table for managing, in association with each other, IP addresses and MAC addresses of local terminals that are terminals connected to a private network managed by the local terminal management device;
a remote terminal management table for managing identifiers of other devices in association with IP addresses of remote terminals that are terminals connected to a private network managed by the other devices;
a local terminal registration unit that assigns an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local terminal and other devices to the local terminal and registers the IP address in the local terminal management table;
a notification unit that notifies other devices of an IP address of the local terminal registered in the local terminal management table;
a remote terminal registration unit that, when receiving a notification of an IP address from another device, registers the received IP address in the remote terminal management table in association with an identifier of the other device that is a sender;
a packet relay unit which reads an IP address of a destination terminal from a packet, and relays the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relays the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
A network management system is provided.

According to a second aspect of the present invention,
a local terminal management table for managing, in association with each other, IP addresses and MAC addresses of local terminals that are connected to a private network managed by the local terminal management device;
a remote terminal management table for managing identifiers of other devices in association with IP addresses of remote terminals that are terminals connected to a private network managed by the other devices;
a local terminal registration unit that assigns an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local terminal and other devices to the local terminal and registers the IP address in the local terminal management table;
a notification unit that notifies other devices of an IP address of the local terminal registered in the local terminal management table;
a remote terminal registration unit that, when receiving a notification of an IP address from another device, registers the received IP address in the remote terminal management table in association with an identifier of the other device that is a sender;
a packet relay unit that reads an IP address of a destination terminal from a packet, and relays the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relays the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
A VPN (Virtual Private Network) device is provided, comprising:

According to a third aspect of the present invention,
Each VPN device includes a local terminal management table for associating and managing an IP address and a MAC address of a local terminal that is a terminal connected to a private network managed by the device itself, and a remote terminal management table for associating and managing an identifier of another device with an IP address of a remote terminal that is a terminal connected to a private network managed by the other device,
a local terminal registration step of assigning an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local device and other devices to the local terminal and registering the IP address in the local terminal management table;
a notification step of notifying another device of the IP address of the local terminal registered in the local terminal management table;
a remote terminal registration step of, when receiving a notification of an IP address from another device, registering the received IP address in the remote terminal management table in association with an identifier of the other device that is a sender;
a packet relay step of reading an IP address of a destination terminal from the packet, and relaying the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relaying the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
A method for managing a network is provided.

According to a fourth aspect of the present invention,
A computer as each VPN device includes a local terminal management table for associating and managing IP addresses and MAC addresses of local terminals that are terminals connected to a private network managed by the device itself, and a remote terminal management table for associating and managing identifiers of other devices and IP addresses of remote terminals that are terminals connected to the private network managed by the other devices,
a local terminal registration process for assigning an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local terminal and other devices to the local terminal and registering the IP address in the local terminal management table;
a notification process for notifying other devices of an IP address of the local terminal registered in the local terminal management table;
a remote terminal registration process for, when receiving a notification of an IP address from another device, registering the received IP address in the remote terminal management table in association with an identifier of the other device that is the sender;
executes a packet relay process for reading an IP address of a destination terminal from the packet, and relaying the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relaying the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
A network management program is provided.

According to each aspect of the present invention, a network management system, a VPN device, a network management method, and a network management program are provided that contribute to terminals being able to move between remote locations without interrupting communications between terminals while reducing network management costs.

FIG. 1 is a diagram for explaining an overview of the present invention. 1 is a block diagram showing an example of a configuration of a VPN device 100. FIG. 3 is a diagram showing an example of information registered in a local terminal management table 10. FIG. 4 is a diagram showing an example of information registered in a remote terminal management table 20. FIG. FIG. 1 is a diagram showing a conventional technique for explaining a comparison between the conventional technique and the present invention; FIG. 1 is a diagram illustrating the present invention in comparison with the prior art; 4 is a flowchart showing a flow of processing by the VPN device 100. 4 is a flowchart showing a flow of processing by the VPN device 100. 4 is a flowchart showing a flow of processing by the VPN device 100. 4 is a flowchart showing a flow of processing by the VPN device 100. 4 is a flowchart showing a flow of processing by the VPN device 100. 4 is a flowchart showing a flow of processing by the VPN device 100. 4 is a flowchart showing a flow of processing by the VPN device 100. FIG. 1 illustrates an example of a computer serving as a VPN device 100.

A preferred embodiment of the present invention will be described in detail with reference to the drawings. Note that the reference symbols in the drawings are added to each element for convenience as an example to aid understanding, and are not intended to limit the present invention to the illustrated form. Furthermore, the connection lines between blocks in each drawing include both bidirectional and unidirectional lines. One-way arrows are used to indicate the flow of the main signal (data) and do not exclude bidirectionality. Furthermore, although not explicitly shown, input and output ports exist at the input and output ends of each connection line in the circuit diagrams, block diagrams, internal configuration diagrams, connection diagrams, etc. shown in this disclosure. The same applies to input/output interfaces.

First, an overview of the present invention will be described. As shown in FIG. 1, a network management system 1000 includes multiple VPN (Virtual Private Network) devices 100. Each VPN device 100 has the same configuration and is identified by VPN numbers 1 to 3. For example, the VPN device 100 with VPN number 1 is written as VPN device (1). Terminals 1 and 2 are connected to VPN device (1) and manage PN1 (private network 1). Similarly, terminals 3 and 4 are connected to VPN device (2) and manage PN2, and terminals 5 and 6 are connected to VPN device (3) and manage PN3.

As shown in FIG. 2, each VPN device 100 includes a local terminal management table 10, a remote terminal management table 20, a local terminal registration unit 30, a notification unit 40, a remote terminal registration unit 50, and a packet relay unit 60.

The local terminal management table 10 manages the IP address and MAC address of a local terminal, which is a terminal connected to a private network managed by the own device (own VPN device), in association with each other (see FIG. 3). The remote terminal management table 20 manages the identifier of another device (another VPN device) in association with the IP address of a remote terminal, which is a terminal connected to a private network managed by the other device (see FIG. 4). The local terminal registration unit 30 assigns an IP address corresponding to a security policy commonly used in multiple private networks managed by the own device and the other device to the local terminal and registers it in the local terminal management table 10. The notification unit 40 notifies the other device of the IP address of the local terminal registered in the local terminal management table 10. When the remote terminal registration unit 50 receives a notification of an IP address from the other device, it registers the received IP address in the remote terminal management table 20 in association with the identifier of the other device that is the sender. The packet relay unit 60 reads the IP address of the destination terminal from the packet, and if the read IP address is registered in the local terminal management table 10, relays the packet to a local terminal with a MAC address corresponding to the read IP address. If the read IP address is registered in the remote terminal management table 20, the packet relay unit 60 relays the packet to another device with an identifier corresponding to the read IP address.

By doing this, the present invention makes it possible to reduce network management costs and to allow terminals to move between remote locations without interrupting communications between terminals.

In terms of comparison with the conventional technology, in the past, a network segment was determined for each private network, as shown in FIG. 5. Then, a security policy for the network address segment assigned to each remote location is set in each firewall. For example, a security policy such as 192.168.0.XXX is set in the private network managed by VPN device A, and an IP address such as 192.168.0.001 is assigned to terminal A1 under VPN device A. Also, a security policy such as 192.168.1.XXX, which is different from that under VPN device A, is set in the private network managed by VPN device B. Under such circumstances, if terminal A1 under VPN device A is moved to VPN device B, the security policy under VPN device B is not applied to terminal A1. Therefore, it is necessary to newly assign an IP address such as 192.168.1.003 to terminal A1 that has been moved to VPN device B. Alternatively, the security policy itself needs to be dynamically changed so that the security policy under VPN device B is applied to terminal A1.

On the other hand, in the present invention, a common security policy such as 192.168.000.XXX is set under VPN devices C and D, and terminals under each VPN device are assigned IP addresses corresponding to the commonly used security policy. Under such circumstances, when terminal C1 under VPN device C is moved to VPN device D, the present invention applies the security policy under VPN device D without changing the IP address of terminal C1: 192.168.000.001. There is also no need to change the security policy under VPN device D. In other words, in the present invention, even if a terminal moves between private networks, the security policy of the destination is applied while maintaining the IP address. Therefore, according to the present invention, it is possible to move a terminal to a remote location without interrupting communication between terminals while suppressing network management costs.

[Embodiment 1]
Next, the above-mentioned network management system 1000 will be described in more detail as embodiment 1. The configuration of the network management system 1000 of embodiment 1 is similar to the above-mentioned overview (FIG. 1), and in particular, each VPN device 100 is connected to each other by VPN communication. The configuration of each VPN device 100 is also similar to the above-mentioned overview (FIG. 2).

The local terminal management table 10 stores the IP addresses and MAC addresses of local terminals in association with each other, as shown in FIG. 3. The remote terminal management table 20 stores the PN numbers, which are identifiers of other devices (other VPN devices), in association with the IP addresses of remote terminals, as shown in FIG. 4.

The local terminal registration unit 30 detects a terminal connection to its own device (its own VPN device) using ARP (Address Resolution Protocol), and adds a pair of the detected terminal's MAC address and IP address to the local terminal management table 10. For example, when the VPN device (1) in FIG. 1 detects a connection of terminal 1, it adds a pair of terminal 1's MAC address XX:XX:XX:XX:XX:XX:XX and IP address 192.168.000.001 to the local terminal management table 10. The IP address is assigned, for example, according to DHCP (Dynamic Host Configuration Protocol). This IP address corresponds to a security policy commonly used in all private networks.

The local terminal registration unit 30 may maintain the IP address already assigned to the terminal that detected the connection if the IP address corresponds to the security policy. In other words, if the IP address already assigned to the terminal corresponds to the security policy, the terminal is considered to have moved from under another VPN device 100. On the other hand, if the IP address already assigned to the terminal does not correspond to the security policy, a new IP address corresponding to the security policy is assigned, for example, by using an authentication VLAN (Virtual Local Area Network) in combination with DHCP. In this way, it becomes possible to maintain the IP address as long as the terminal moves within the VPN.

Furthermore, when the local terminal registration unit 30 detects a terminal disconnection by ARP, it deletes the pair of MAC address and IP address from the local terminal management table 10. For example, when the VPN device (1) in FIG. 1 detects the disconnection of terminal 2, the local terminal registration unit 30 deletes the pair of IP address 192.168.000.002 and YY:YY:YY:YY:YY:YY from the local terminal management table 10 in FIG. 1.

When the local terminal registration unit 30 detects a terminal connection, the notification unit 40 transmits the addition of the terminal's IP address information to all other devices (other VPN devices 100) via the VPN connection. For example, when the VPN device (1) in FIG. 1 detects the connection of terminal 1, the notification unit 40 transmits the addition of IP address 192.168.000.001 to VPN device (2) and VPN device (3). When the local terminal registration unit 30 detects a terminal disconnection, the notification unit 40 transmits the deletion of the terminal's IP address information to all other devices (other VPN devices 100) via the VPN connection. When a new VPN connection between remote locations is established, the notification unit 40 transmits the addition of all IP addresses in the local terminal management table 10 to the connected VPN device 100. For example, if VPN device (1) in Figure 1 detects the establishment of a VPN connection with VPN device (2), it sends the addition of IP addresses 192.168.000.001 and 192.168.000.002 to VPN2.

When the remote terminal registration unit 50 receives an addition of a terminal's IP address via a VPN connection, it deletes any information about that IP address from the local terminal management table 10 and the remote terminal management table 20. The remote terminal registration unit 50 then adds a new pair of PN number and IP address to the remote terminal management table 20. For example, when the VPN device (1) in FIG. 1 receives an addition of IP address 192.168.000.003 from the VPN device (2), it adds a pair of PN2 and IP address 192.168.000.003 to the remote terminal management table 20. When the remote terminal registration unit 50 receives a deletion of the terminal's IP address information via a VPN connection, it deletes the pair of PN number and IP address from the remote terminal management table 20. For example, when the VPN device (1) in FIG. 1 receives a deletion of IP address 192.168.000.005 from the VPN device (3), it deletes the pair of PN3 and IP address 192.168.000.005 from the remote terminal management table 20. Also, when the VPN connection between remote locations is disconnected, the remote terminal registration unit 50 deletes all information corresponding to the VPN connection from the remote terminal management table 20. For example, when the VPN device (1) in FIG. 1 detects the disconnection of the VPN connection with the VPN device (2), it deletes the pair of PN2 and IP address 192.168.000.003 and the pair of PN2 and IP address 192.168.000.004.

When the packet relay unit 60 receives a packet from a terminal or another VPN device 100, it forwards the packet in the following procedure.
(1) Read the packet destination IP address.
(2) If the read IP address exists in the local terminal management table 10, a packet is sent to the corresponding MAC address.
(3) If the read IP address exists in the remote terminal management table 20, the packet is sent to the corresponding VPN device 100 via the VPN connection.
(4) If the packet was not sent in (2) and (3) above, the packet is discarded.

The following describes the flow of processing by the VPN device 100. As shown in FIG. 7, when the VPN device 100 detects a terminal connection to its own device by ARP (step S01, Yes), it adds a pair of the MAC address and IP address of the detected terminal to the local terminal management table 10 (step S02). The VPN device 100 then transmits the addition of the terminal's IP address information to all other devices (other VPN devices 100) via the VPN connection (step S03).

As shown in FIG. 8, when the VPN device 100 detects a terminal disconnection by ARP (step S11, Yes), it deletes the pair of MAC address and IP address from the local terminal management table 10 (step S12). Then, the VPN device 100 transmits a deletion of the IP address information to all other devices (other VPN devices 100) via the VPN connection (step S13).

Also, as shown in FIG. 9, when a new VPN connection is established between remote locations (step S21, Yes), the VPN device 100 sends an addition of all IP addresses in the local terminal management table 10 to the connected VPN device 100 (step S22).

Also, as shown in FIG. 10, when the VPN device 100 receives a request to add an IP address (step S31, Yes), it adds a pair of the PN number and the IP address to the remote terminal management table 20 (step S32).

Also, as shown in FIG. 11, when the VPN device 100 receives a command to delete IP address information (step S41, Yes), it deletes the pair of PN number and IP address from the remote terminal management table 20 (step S42).

Also, as shown in FIG. 12, if the VPN connection between remote locations is disconnected (step S51, Yes), the VPN device 100 deletes all information corresponding to the VPN connection from the remote terminal management table (step S52).

As shown in FIG. 13, when the VPN device 100 receives a packet (step S61, Yes), it reads the packet destination IP address (step S62). If the read IP address exists in the local terminal management table 10 (step S63, Yes), the VPN device 100 transmits the packet to the corresponding MAC address (step S64). If the read IP address exists in the remote terminal management table 20 (step S65, Yes), the VPN device 100 transmits the packet to the corresponding VPN device 100 via the VPN connection (step S66). If both steps S63 and S65 are No, the VPN device 100 discards the packet (step S67). After steps S64, S66, and S67, the VPN device 100 waits to receive a packet again (step S61).

The present invention can also be realized by a computer serving as the VPN device 100. Specifically, as shown in FIG. 14, the computer serving as the VPN device 100 includes a memory, an interface, a CPU (Central Processing Unit), and the like. The memory stores a local terminal management table 10 and a remote terminal management table 20. The CPU reads out a program from the memory and realizes processing modules corresponding to the local terminal registration unit 30, the notification unit 40, the remote terminal registration unit 50, and the packet relay unit 60.

Some or all of the above embodiments may be described as follows, but are not limited to the following:

(Appendix 1)
A plurality of VPN (Virtual Private Network) devices are included;
Each VPN device:
a local terminal management table for managing, in association with each other, IP addresses and MAC addresses of local terminals that are connected to a private network managed by the local terminal management device;
a remote terminal management table for managing identifiers of other devices in association with IP addresses of remote terminals that are terminals connected to a private network managed by the other devices;
a local terminal registration unit that assigns an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local terminal and other devices to the local terminal and registers the IP address in the local terminal management table;
a notification unit that notifies other devices of an IP address of the local terminal registered in the local terminal management table;
a remote terminal registration unit that, when receiving a notification of an IP address from another device, registers the received IP address in the remote terminal management table in association with an identifier of the other device that is a sender;
a packet relay unit which reads an IP address of a destination terminal from a packet, and relays the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relays the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
Network Management Systems.

(Appendix 2)
the local terminal registration unit, when an IP address already assigned to the local terminal corresponds to a security policy commonly used in the plurality of private networks, registers the already assigned IP address in the local terminal management table;
2. The network management system of claim 1.

(Appendix 3)
3. The network management system according to claim 1, wherein the local terminal registration unit detects a terminal connection to the local device using ARP (Address Resolution Protocol) and adds a pair of a MAC address and an IP address of the detected terminal to a local terminal management table.

(Appendix 4)
3. The network management system according to claim 1, wherein each VPN device is connected to each other by VPN communication.

(Appendix 5)
a local terminal management table for managing, in association with each other, IP addresses and MAC addresses of local terminals that are terminals connected to a private network managed by the local terminal management device;
a remote terminal management table for managing identifiers of other devices in association with IP addresses of remote terminals that are terminals connected to a private network managed by the other devices;
a local terminal registration unit that assigns an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local terminal and other devices to the local terminal and registers the IP address in the local terminal management table;
a notification unit that notifies other devices of an IP address of the local terminal registered in the local terminal management table;
a remote terminal registration unit that, when receiving a notification of an IP address from another device, registers the received IP address in the remote terminal management table in association with an identifier of the other device that is a sender;
a packet relay unit that reads an IP address of a destination terminal from a packet, and relays the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relays the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
A VPN (Virtual Private Network) device comprising:

(Appendix 6)
Each VPN device includes a local terminal management table for associating and managing an IP address and a MAC address of a local terminal that is a terminal connected to a private network managed by the device itself, and a remote terminal management table for associating and managing an identifier of another device with an IP address of a remote terminal that is a terminal connected to a private network managed by the other device,
a local terminal registration step of assigning an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local device and other devices to the local terminal and registering the IP address in the local terminal management table;
a notification step of notifying another device of the IP address of the local terminal registered in the local terminal management table;
a remote terminal registration step of, when receiving a notification of an IP address from another device, registering the received IP address in the remote terminal management table in association with an identifier of the other device that is a sender;
a packet relay step of reading an IP address of a destination terminal from the packet, and relaying the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relaying the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
Network management methods.

(Appendix 7)
A computer as each VPN device includes a local terminal management table for associating and managing IP addresses and MAC addresses of local terminals that are terminals connected to a private network managed by the device itself, and a remote terminal management table for associating and managing identifiers of other devices and IP addresses of remote terminals that are terminals connected to the private network managed by the other devices,
a local terminal registration process for assigning an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local terminal and other devices to the local terminal and registering the IP address in the local terminal management table;
a notification process for notifying other devices of an IP address of the local terminal registered in the local terminal management table;
a remote terminal registration process for, when receiving an IP address notification from another device, registering the received IP address in the remote terminal management table in association with an identifier of the other device that is the sender;
a packet relay process for reading an IP address of a destination terminal from the packet, and relaying the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relaying the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
Network management programs.

The disclosures of the above cited patent documents are incorporated into this document by reference and may be used as the basis or part of the present invention as necessary. Within the framework of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the framework of the entire disclosure of the present invention, various combinations or selections (including partial deletions) of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure, including the scope of claims, and the technical ideas. In particular, with regard to the numerical ranges described in this document, any numerical value or small range included within the range should be interpreted as being specifically described even if not otherwise specified. Furthermore, the disclosures of the above cited documents may be used in part or in whole in combination with the descriptions in this document as part of the disclosure of the present invention in accordance with the spirit of the present invention as necessary, and are considered to be included in the disclosures of this application.

10: Local terminal management table 20: Remote terminal management table 30: Local terminal registration unit 40: Notification unit 50: Remote terminal registration unit 60: Packet relay unit 100: VPN device 1000: Network management system

Claims (7)

A plurality of VPN (Virtual Private Network) devices are included;
Each VPN device:
a local terminal management table for managing, in association with each other, IP addresses and MAC addresses of local terminals that are terminals connected to a private network managed by the local terminal management device;
a remote terminal management table for managing identifiers of other devices in association with IP addresses of remote terminals that are terminals connected to a private network managed by the other devices;
a local terminal registration unit that assigns an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local terminal and other devices to the local terminal and registers the IP address in the local terminal management table;
a notification unit that notifies other devices of an IP address of the local terminal registered in the local terminal management table;
a remote terminal registration unit that, when receiving a notification of an IP address from another device, registers the received IP address in the remote terminal management table in association with an identifier of the other device that is a sender;
a packet relay unit which reads an IP address of a destination terminal from a packet, and relays the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relays the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
Network Management Systems. the local terminal registration unit, when an IP address already assigned to the local terminal corresponds to a security policy commonly used in the plurality of private networks, registers the already assigned IP address in the local terminal management table;
2. The network management system of claim 1. The network management system according to claim 1 or 2, wherein the local terminal registration unit detects a terminal connection to the device itself by ARP (Address Resolution Protocol) and adds a pair of the MAC address and IP address of the detected terminal to the local terminal management table. The network management system according to claim 1 or 2, wherein each VPN device is connected to each other by VPN communication. a local terminal management table for managing, in association with each other, IP addresses and MAC addresses of local terminals that are connected to a private network managed by the local terminal management device;
a remote terminal management table for managing identifiers of other devices in association with IP addresses of remote terminals that are terminals connected to a private network managed by the other devices;
a local terminal registration unit that assigns an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local terminal and other devices to the local terminal and registers the IP address in the local terminal management table;
a notification unit that notifies other devices of an IP address of the local terminal registered in the local terminal management table;
a remote terminal registration unit that, when receiving a notification of an IP address from another device, registers the received IP address in the remote terminal management table in association with an identifier of the other device that is a sender;
a packet relay unit that reads an IP address of a destination terminal from a packet, and relays the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relays the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
A VPN (Virtual Private Network) device comprising: Each VPN device includes a local terminal management table for associating and managing an IP address and a MAC address of a local terminal that is a terminal connected to a private network managed by the device itself, and a remote terminal management table for associating and managing an identifier of another device with an IP address of a remote terminal that is a terminal connected to a private network managed by the other device,
a local terminal registration step of assigning an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local device and other devices to the local terminal and registering the IP address in the local terminal management table;
a notification step of notifying another device of the IP address of the local terminal registered in the local terminal management table;
a remote terminal registration step of, when receiving a notification of an IP address from another device, registering the received IP address in the remote terminal management table in association with an identifier of the other device that is a sender;
a packet relay step of reading an IP address of a destination terminal from the packet, and relaying the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relaying the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
Network management methods. A computer as each VPN device includes a local terminal management table for associating and managing IP addresses and MAC addresses of local terminals that are terminals connected to a private network managed by the device itself, and a remote terminal management table for associating and managing identifiers of other devices and IP addresses of remote terminals that are terminals connected to the private network managed by the other devices,
a local terminal registration process for assigning an IP address corresponding to a security policy commonly used in a plurality of private networks managed by the local terminal and other devices to the local terminal and registering the IP address in the local terminal management table;
a notification process for notifying other devices of an IP address of the local terminal registered in the local terminal management table;
a remote terminal registration process for, when receiving a notification of an IP address from another device, registering the received IP address in the remote terminal management table in association with an identifier of the other device that is the sender;
a packet relay process for reading an IP address of a destination terminal from the packet, and relaying the packet to a local terminal having a MAC address corresponding to the read IP address if the read IP address is registered in the local terminal management table, and relaying the packet to another device having an identifier corresponding to the read IP address if the read IP address is registered in the remote terminal management table;
Network management programs.

Images