WO2018179448A1

WO2018179448A1 - Control program, control method and control device

Info

Publication number: WO2018179448A1
Application number: PCT/JP2017/013861
Authority: WO
Inventors: 増田　和紀
Original assignee: 富士通株式会社
Priority date: 2017-03-31
Filing date: 2017-03-31
Publication date: 2018-10-04
Also published as: JPWO2018179448A1

Abstract

When having received a setting input for the port of a device that is included in a network to be monitored, a network management device (10) determines whether any authentication VLAN with an authentication function has been set for the port; the network management device blocks the setting input in the case of determining that an authentication VLAN has been set for the port; and the network management device permits the setting input in the case of determining that no authentication VLAN has been set for the port.

Description

Control program, control method, and control apparatus

The present invention relates to a control program, a control method, and a control device.

In the initial stage when a network is constructed in a corporate system, for example, experts such as SE (System Engineer) connect to a network device via a protocol such as telnet, and via CLI (Command Line Interface) etc. Various network settings are made.

After that, network operations will also change due to business additions, business changes, or changes in the importance of business in the corporate system. In accordance with this change in operation, as an example, there is a case where registration, deletion, or change of a VLAN (Virtual Local Area Network) setting is performed. Since such a change in operation can occur on a daily basis, the frequency of registering, deleting, and changing VLAN settings tends to increase.

Therefore, using technology such as SDN (Software-Defined Networking), VLAN settings for corporate system networks, such as port VLANs and tag VLANs, also called static VLANs, are implemented in a GUI (Graphical User Interface) environment. Possible functions are provided to network administrators and the like.

JP 2007-208323 A

However, with the above technology, settings such as port VLAN and tag VLAN may be overwritten on the port where the authentication VLAN is set. When settings such as a port VLAN and a tag VLAN are input to a port for which an authentication VLAN is set in this way, it is not possible to input an authentication VLAN setting to the port in the GUI environment. Therefore, if an expert such as SE does not input the authentication VLAN setting in the CLI environment, the authentication VLAN setting cannot be restored.

In one aspect, an object of the present invention is to provide a control program, a control method, and a control apparatus that can suppress overwriting of a setting for a port in which an authentication VLAN is set.

In one aspect, when receiving a setting input for a port of a device included in a network to be monitored, the control program determines whether an authentication VLAN with an authentication function is set for the port, When it is determined that an authentication VLAN is set for the port, the setting input is restricted, and when it is determined that an authentication VLAN is not set for the port, the setting input is permitted. Let the computer run.

∙ Overwriting of settings for ports with an authentication VLAN can be suppressed.

FIG. 1 is a diagram illustrating a configuration example of a network management system according to the first embodiment. FIG. 2 is a block diagram illustrating a functional configuration of the network management apparatus according to the first embodiment. FIG. 3 is a diagram illustrating an example of a control sequence of authentication processing. FIG. 4 is a diagram illustrating an example of the VLAN setting screen. FIG. 5 is a diagram illustrating an example of the VLAN setting screen. FIG. 6 is a flowchart (1) illustrating the procedure of the control process according to the first embodiment. FIG. 7 is a flowchart (2) illustrating the procedure of the control process according to the first embodiment. FIG. 8 is a diagram illustrating an example of the VLAN setting screen. FIG. 9 is a diagram illustrating a hardware configuration example of a computer that executes a control program according to the first and second embodiments.

Hereinafter, a control program, a control method, and a control device according to the present application will be described with reference to the accompanying drawings. Note that this embodiment does not limit the disclosed technology. Each embodiment can be appropriately combined within a range in which processing contents are not contradictory.

[System configuration]
FIG. 1 is a diagram illustrating a configuration example of a network management system according to the first embodiment. A network management system 1 shown in FIG. 1 provides a network management service that implements settings related to a network NW built in a monitoring target system 3 such as an enterprise system via a GUI. As part of this network management service, the network management system 1 implements a control process that suppresses overwriting of settings for a port in which an authentication VLAN with an authentication function is set via the CLI.

As shown in FIG. 1, the network management system 1 includes a network management device 10, a client terminal 50, and a monitoring target system 3. The monitoring target system 3 includes an authentication server 20, network devices 30A to 30C, and user terminals 40A to 40C. Hereinafter, the network devices 30A to 30C may be collectively referred to as “network device 30”, and the user terminals 40A to 40C may be collectively referred to as “user terminal 40”.

Here, in FIG. 1, the network devices 30A to 30C corresponding to the edge switches in the network NW are extracted and shown, but the substance of the network NW is not restricted to the network configuration shown in the figure. That is, the network NW does not prevent the network devices other than those shown in the figure, such as routers, core switches, and edge routers, from being included, and the number of edge switches may be an arbitrary number. FIG. 1 shows an example in which one user terminal 40 is accommodated in the network device 30 for convenience of explanation. However, this is merely an example, and two or more user terminals 40 are accommodated. It is also good to do. In addition, the device accommodated in the network device 30 is not necessarily limited to the user terminal 40, and other devices such as peripheral devices may be connected.

The network management device 10 is a computer that provides the network management service. The network management device 10 is an example of a monitoring device.

As one embodiment, the network management apparatus 10 can be implemented as an SDN (Software-Defined Networking) controller by installing package software and online software for realizing the network management service on a desired computer. As an example of the network NW, the network management device 10 executes management including monitoring, setting, and control of Carrier Ethernet (registered trademark) such as IP-VPN (Internet Protocol Virtual Private Network) and wide area Ethernet (registered trademark). can do. As described above, the network NW managed by the network management apparatus 10 is not limited to a physical network, and may be a virtual network virtualized by a technique such as SDN or NFV (Network Function Virtualization).

The authentication server 20 is a server device that authenticates the user terminal 40 or the user of the user terminal 40. For this authentication, as an example, IEEE 802.1X authentication, MAC (Media Access Control) -based authentication, or the like can be employed. For example, when IEEE 802.1X authentication is used, the authentication server 20 includes a RADIUS (Remote Authentication Dial-In User Service) server that can exchange an EAP (Extensible Authentication Protocol) message with the user terminal 40. Adopted.

The network device 30 is a device that forms the network NW of the monitoring target system 3. The network device 30 corresponds to an edge switch to which the user terminal 40 and peripheral devices are connected on the network NW. For example, the network device 30 can employ a smart switch or the like.

The user terminal 40 is a terminal device used by a user. An example of the user terminal 40 is a general-purpose computer such as a desktop or notebook personal computer.

The client terminal 50 is a computer that receives the network management service. As an example, the client terminal 50 is used by a related person such as a network administrator who manages the network NW. Here, by providing the network management service, the client terminal 50 does not necessarily have to have a telnet operating environment. For example, the client terminal 50 may be any computer having a general-purpose browser operating environment.

Here, as an example only, user authentication of the user terminal 40 connected to a port in which the dynamic VLAN is enabled, for example, a port in which an authentication VLAN with an authentication function is set, among ports of the network device 30 is IEEE 802. A case where it is realized by 1X authentication will be described. Hereinafter, among the ports of the network device 30, a port for which an authentication VLAN is set may be referred to as an “authentication port”.

In this way, when conforming to the IEEE 802.1X authentication regulations, the authentication server 20, the network device 30, and the user terminal 40 are components of the authentication mechanism. The user terminal 40 corresponds to “supplicant”, the network device 30 corresponds to “authenticator”, and the authentication server corresponds to “Authentication Server”. These authentication server 20, network device 30, and user terminal 40 cooperate to execute user authentication.

FIG. 3 is a diagram showing an example of a control sequence for authentication processing. As shown in FIG. 3, the user terminal 40 connected to the authentication port transmits an EAPOL (Extensible Authentication Protocol over LAN) start frame to the network device 30 in order to start communication with the authentication server 20. (Step S11). In response to the transmission of the start frame, the network device 30 notifies the user terminal 40 of a request for authentication information (step S12).

After this step S12, the exchange of the EAP message is started between the user terminal 40 and the authentication server 20. That is, the user terminal 40 transmits a MAC frame in which an EAP message including a user ID (IDentification) and authentication information is encapsulated to the network device 30 (step S13). This EAP message can include arbitrary authentication information, for example, a certificate issued by a certificate authority, in addition to a password, in accordance with an authentication method applied to user authentication. Subsequently, the network device 30 transfers the MAC frame transmitted from the user terminal 40 to the authentication server 20 (step S14).

Thereafter, the authentication server 20 performs user authentication using the authentication information included in the EAP message (step S15). That is, the authentication server 20 is set with a user file in which authentication information for verification and a VLAN ID are associated with each user ID. With reference to this user file, the authentication server 20 checks whether the authentication information transmitted from the user terminal 40 matches the authentication information associated with the user ID transmitted from the user terminal 40. As a result, user authentication is performed. For the user authentication, any authentication method such as EAP-TLS (Transport Layer Security), LEAP, PEAP, EAP-MD5, EAP-RADIUS, or the like can be applied.

When this user authentication is successful, a VLAN ID corresponding to the user ID is issued out of the VLAN IDs described in the user file. On the other hand, if user authentication fails, the guest VLAN ID is issued if the guest VLAN ID is set. If the guest's VLAN ID is not set, no VLAN ID is issued when user authentication fails.

Thereafter, the authentication server 20 transmits the authentication result together with the VLAN ID to the network device 30 (step S16). Subsequently, the network device 30 assigns the VLAN ID issued by the authentication server 20 to the authentication port (step S17). Then, the network device 30 transmits the authentication result to the user terminal 40 (step S18), and ends the process.

Through this series of processing, different VLAN IDs can be dynamically allocated to the authentication port according to the user ID that succeeds in user authentication. Here, user authentication is taken as an example as an example, but the authentication performed by the authentication server 20 may not necessarily be user authentication. For example, when the device connected to the authentication port is a peripheral device, MAC-based authentication that can omit the input of authentication information can be used. That is, when the MAC address of the peripheral device matches the MAC address registered in the authentication server 20, the VLAN ID associated with the MAC address can be assigned to the authentication port.

[Configuration of Network Management Device 10]
FIG. 2 is a block diagram illustrating a functional configuration of the network management apparatus 10 according to the first embodiment. As illustrated in FIG. 2, the network management apparatus 10 includes a communication I / F (interface) unit 11, a storage unit 13, and a control unit 15. The network management apparatus 10 may include various functional units included in known computers, for example, functional units such as various input devices and audio output devices, in addition to the functional units illustrated in FIG.

The communication I / F unit 11 is an interface that performs communication control with other devices such as the network device 30 and the client terminal 50.

As an embodiment, the communication I / F unit 11 can employ a network interface card such as a LAN (Local Area Network) card. For example, the communication I / F unit 11 transmits various commands to the network device 30, and receives all or part of the Config information and MIB (Management Information Base) stored in the network device 30 from the network device 30. Or Further, the communication I / F unit 11 accepts an editing operation or the like for the setting of the network device 30 from the client terminal 50, or transmits a topology map screen or the like in which the connection shape of the network NW is modeled to the client terminal 50. .

The storage unit 13 is a storage device that stores data used for various programs such as an OS (Operating System) executed by the control unit 15 and a network management program for realizing the network management service.

As an embodiment, the storage unit 13 can be implemented as an auxiliary storage device in the network management device 10. For example, the storage unit 13 may employ an HDD (Hard Disk Drive), an optical disk, an SSD (Solid State Drive), or the like. Note that the storage unit 13 does not necessarily have to be mounted as an auxiliary storage device, and can also be mounted as a main storage device in the network management device 10. In this case, various semiconductor memory elements such as RAM (Random Access Memory) and flash memory can be employed for the storage unit 13.

The storage unit 13 stores topology information 13a as an example of data used in a program executed by the control unit 15. In addition to the topology information 13a, other electronic data can be stored together. For example, the storage unit 13 also includes user authority information in which a network device 30 or a group of network devices 30 that allows a setting operation and browsing for each user is specified in order to manage authority of a user such as a network administrator. Can be remembered.

The topology information 13a is information related to the connection shape of the network NW. The topology information 13a includes device information 13a1, port information 13a2, link information 13a3, and the like.

Of these, the device information 13a1 defines information related to the network device 30. For example, the device information 13a1 can employ data in which items such as a device ID and a device name are associated. The “device ID” here refers to identification information for identifying the network device 30. The “device name” refers to a name defined for the network device 30. Here, the device name is illustrated as an example of the item that defines the network device 30, but other items such as a manufacturing number and a model number may be further included in the device information 13a1.

Also, the port information 13a2 defines information related to the ports that the network device 30 has. For example, data associated with items such as port ID, device ID, port name, operation mode, untag VLAN, tag VLAN, and dynamic VLAN can be adopted as the port information 13a2. Here, the “port ID” refers to identification information for identifying a port included in the network device 30. “Device ID” refers to the identification information of the network device 30 as in the case of the device ID included in the device information 13a1, and here it means the network device 30 having the port identified by the port ID. . “Port name” refers to a name defined for a port. The “operation mode” refers to a mode in which the port operates according to various VLAN settings. For example, an access port in which a static VLAN, so-called port-based VLAN is set, is described as “access”. A trunk port in which the tag VLAN is set is described as “trunk”. Further, “dynamic” is described in the authentication port in which the dynamic VLAN is enabled. “Untag VLAN” is a field in which the VLAN ID of the static VLAN set for the port is described. Further, “tag VLAN” is a field in which the VLAN ID of the tag VLAN set for the port is described. The “dynamic VLAN ID” is a field in which the VLAN ID assigned to the authentication port by the authentication server 20 is described.

Also, the link information 13a3 defines information related to a link that connects ports of the network device 30. For example, data in which items such as a link ID, device ID1, port ID1, device ID2, and port ID2 are associated can be adopted as the link information 13a3. Here, “link ID” refers to identification information for identifying a link. “Port ID 1” and “Port ID 2” indicate port identification information as in the case of the port ID included in the port information 13a2, but here, the two ports connected to the link identified by the link ID. Means identification information. Furthermore, “device ID 1” and “device ID 2” indicate identification information of the network device 30 as in the case of the device ID included in the device information 13a1, but here, the network device 30 having a port identified by the port ID 1 And the identification information of the network device 30 having the port identified by the port ID 2. As described above, in the link information 13a3, among the ports included in the device information 13a1, a connected port or a port after link-up is registered.

The control unit 15 is a processing unit that performs overall control of the network management apparatus 10.

As one embodiment, the control unit 15 can be implemented by a hardware processor such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). Here, the CPU and the MPU are illustrated as an example of the processor. However, the processor and the MPU can be mounted by any processor regardless of a general-purpose type or a specialized type. In addition, the control unit 15 may be realized by hard wired logic such as ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

The control unit 15 is a control program that realizes the above network management service functions on a RAM work area such as DRAM (Dynamic Random Access Memory) or SRAM (Static Random Access Memory) that is implemented as a main storage device (not shown). By expanding the above, the following processing unit is virtually realized.

As shown in FIG. 2, the control unit 15 includes a collection unit 15a, a display control unit 15b, a reception unit 15c, a determination unit 15d, and a setting control unit 15e.

The collection unit 15 a is a processing unit that collects various types of information from the network device 30.

As one embodiment, the collection unit 15a collects information on the topology and VLAN settings from the network device 30 on the network NW at the following timing. As an example of the timing at which such collection is executed, an instruction is input via the client terminal 50 in addition to the case where the time since the previous acquisition is executed passes a predetermined period, for example, 5 seconds. In some cases, the system time stored in an internal memory (not shown) reaches a predetermined regular time, for example, 6 o'clock, 12 o'clock, 18 o'clock, or the like.

For example, when information about the topology is collected, the collection unit 15a transmits commands such as show running-config and show interfaces status to the network device 30 on the network NW. Thereby, the link-up state of the port can be acquired as the return value of the command. Furthermore, the collection unit 15a transmits a command such as show cdp neighbors to the network device 30 on the network NW. As a result, information advertised via the LLDP (Link Layer Discovery Protocol) between the command destination network device 30 and the network device 30 to which the command destination network device 30 is adjacent is connected, for example. Port information etc. can be acquired as command return values. According to the information collected using these commands, the collection unit 15a generates the topology information 13a and newly registers it in the storage unit 13 or updates the topology information 13a stored in the storage unit 13. .

In addition, although the case where the registration and update of the topology information 13a is performed according to the information acquired by the collection unit 15a is illustrated here, these registration and update can be realized by other methods. For example, the topology information 13a can be registered and updated from the MIB information acquired from the network device 30. Further, it may be input by the network administrator or the like via the client terminal 50. In this case, as an example, the topology map screen can be drawn by accepting via the client terminal 50 the arrangement of device icons and the drawing of links connecting ports.

Also, when various VLAN settings for a port are acquired, the collection unit 15a transmits commands such as show vlan and show interfaces trunk to the network device 30 on the network NW. Thereby, for each port, various VLAN settings for the port can be acquired as a return value of the command. For example, in addition to the port operation mode, various VLAN setting values are acquired. That is, when the operation mode is “access”, the VLAN ID of the port-based VLAN set as the access port is acquired. When the operation mode is “trunk”, the VLAN ID of the tag VLAN set in the trunk port is acquired. When the operation mode is “dynamic”, the VLAN ID of the authentication VLAN assigned to the authentication port is acquired. According to the information collected using these commands, the collection unit 15a assigns setting values to the fields related to VLAN settings included in the port information 13a2 of the topology information 13a, that is, the operation mode, untag VLAN, tag VLAN, and dynamic VLAN. Register new or update.

The display control unit 15b is a processing unit that performs display control on the client terminal 50.

As one aspect, the display control unit 15b refers to the topology information 13a stored in the storage unit 13 and causes the client terminal 50 to display a topology map screen in which connection shapes between devices included in the network NW are modeled. . For example, the display control unit 15b arranges between the device icons in which the network device 30 corresponding to the device ID defined in the device information 13a1 in the topology information 13a is schematically illustrated. Further, the display control unit 15b further expands and displays symbols in which each port of the network device 30 corresponding to the device icon is modeled according to the port information 13a2 in the topology information 13a. Further, the display control unit 15b further draws a line drawing of a link connecting the symbols of the ports of the network device 30 in which the port ID1 and the port ID2 are registered in the link information 13a3 in the topology information 13a. The topology map screen generated in this way is displayed on the client terminal 50. Further, the display control unit 15b performs a call operation of the VLAN setting screen with the network device 30 selected on the topology map screen, for example, a VLAN setting menu operation or a right click provided in a window different from the topology map screen. When an operation such as the above is performed, a VLAN setting screen for setting the network device 30 that has been selected can be called.

The accepting unit 15c is a processing unit that accepts a setting input related to the VLAN.

As one embodiment, the accepting unit 15c accepts a setting input related to the VLAN on the VLAN setting screen displayed on the client terminal 50. FIG. 4 is a diagram illustrating an example of the VLAN setting screen. FIG. 4 shows a VLAN setting screen for Node-1. As illustrated in FIG. 4, the VLAN setting screen 400 includes a list of setting states related to ports included in the network device 30 to be set. Specifically, the VLAN setting screen 400 includes an operation mode, a port-based VLAN, and a tag VLAN for each of 11 interfaces of Ethernet (registered trademark) 1/0/1 to Ethernet (registered trademark) 1/0/11. And the setting status of the dynamic VLAN are displayed. Among these, a pull-down menu is provided in the operation mode column. Through the operation on the pull-down menu, the operation mode can be edited from the current operation mode to “access” or “trunk”. Here, since the activation of the dynamic VLAN, that is, the change to the authentication port can be set only by command input via CLI such as telnet, setting input via a pull-down menu which is a GUI component cannot be performed. In addition to editing of such operation modes, it is possible to accept editing of port-based VLAN VLAN IDs and tag VLAN VLAN IDs through text boxes provided in columns such as untag VLAN, tag VLAN, and dynamic VLAN. it can. As described above, when the OK button 410 or the apply button 430 is pressed after the editing is received through the GUI component of the VLAN setting screen 400, the receiving unit 15c sets the content of the editing received through the GUI component. Accept as input. When the cancel button 420 is pressed, the content accepted for editing via the GUI component is canceled without setting input.

The determination unit 15d is a processing unit that determines whether or not an authentication VLAN is set for a port when a setting input is received for the port of the network device 30 included in the network NW.

As an embodiment, the determination unit 15d refers to the port information 13a2 included in the topology information 13a stored in the storage unit 13 and performs the following processing for each port for which the setting input is received by the reception unit 15c. Execute. That is, the determination unit 15d refers to the operation mode of the port having the device ID of the network device 30 that has received the setting input and the port ID that has received the setting input, among the operation modes of the ports included in the port information 13a2. . Then, the determination unit 15d determines whether or not the operation mode of the port referred to from the port information 13a2 is “dynamic”. At this time, when the operation mode of the port is “dynamic”, since the authentication VLAN is set to the port for which the setting input has been accepted, the port can be identified as the “authentication port”. On the other hand, when the operation mode of the port is not “dynamic”, since the authentication VLAN is not set to the port for which the setting input is accepted, the port can be identified as the “access port” or the “trunk port”.

Further, the determination unit 15d acquires a VLAN ID list of the authentication VLAN when the port for which the setting input is accepted is not the “authentication port”. For example, the determination unit 15d searches for a field in which the dynamic VLAN ID column value included in the port information 13a2 is not a null value. Thereafter, the determination unit 15d creates a VLAN ID list of the authentication VLAN by extracting the VLAN ID from the dynamic VLAN ID field obtained as a search result. The VLAN ID list of the authentication VLAN can include a VLAN ID assigned to the authentication port when authentication is successful and a guest VLAN ID assigned to the authentication port when authentication fails. After that, the determination unit 15d determines whether there is a VLAN ID that matches the VLAN ID included in the VLAN ID list of the authentication VLAN among the VLAN IDs specified by the setting input.

The setting control unit 15e is a processing unit that controls permission or restriction of setting for a port.

As one aspect, when the setting input to the authentication port is accepted, the setting control unit 15e regulates the setting input. In other words, the contents accepted for editing via the GUI component are canceled without being reflected in the network device 30. Furthermore, the setting control unit 15e outputs an alert that warns of a setting input for the authentication port. For example, in the example of FIG. 4, Ethernet (registered trademark) 1/0/10 is an authentication port because the operation mode is “dynamic”. When a setting input is made to this Ethernet (registered trademark) 1/0/10, the setting input is restricted, and a warning message such as “The setting of the authentication port cannot be changed” is displayed in a pop-up or the like. it can. Also, the alert output form is not limited to display, and a warning message can also be output as voice. As a result, it is possible to suppress the setting of the port VLAN and the tag VLAN from being overwritten on the port in which the authentication VLAN is set. In this example, the setting input for the authentication port is accepted and then canceled. However, as will be described later, although the setting status of the authentication port operation mode and dynamic VLAN ID is displayed, the operation for the authentication port is performed. The setting input may be restricted by masking the GUI component.

As another aspect, the setting control unit 15e matches the VLAN ID included in the VLAN ID list of the authentication VLAN in the VLAN ID specified by the setting input, even if the port from which the setting input is received is not “authentication port”. If there is something to do, the setting input is restricted. Further, the setting control unit 15e outputs an alert for warning the use of the VLAN ID assigned to the authentication port. FIG. 5 is a diagram illustrating an example of the VLAN setting screen. As shown in FIG. 5, in the VLAN setting screen 500, the port ID of the VLAN ID setting “101” for the access port with the interface name “Ethernet (registered trademark) 1/0/9” is input by the authentication server 20 to the authentication port. The reception status that matches the VLAN ID “101” assigned to is shown. When such setting input is permitted, the VLAN ID of the user terminal 40 or peripheral device connected to the access port with the interface name “Ethernet (registered trademark) 1/0/9” does not pass through user authentication or MAC-based authentication. It is possible to connect to the virtual network “101”. Therefore, the VLAN ID setting input “101” of the port-based VLAN for the access port of the interface name “Ethernet (registered trademark) 1/0/9” is restricted. Furthermore, a warning message such as “The VLAN ID used in the authentication VLAN cannot be set” can be displayed in a pop-up or the like. Also in this case, the alert output form is not limited to display, and a warning message can also be output as a voice. In addition, the text box in which the port base VLAN VLAN ID setting input “101” for the access port with the interface name “Ethernet (registered trademark) 1/0/9” is displayed in a display form different from other text boxes. It can also be displayed.

As a further aspect, the setting control unit 15e matches the VLAN ID included in the VLAN ID list of the authentication VLAN in the VLAN ID specified by the setting input, and the port from which the setting input has been received is not an “authentication port”. If there is nothing to do, the setting input is permitted. That is, the setting control unit 15e generates a command corresponding to the contents set and input on the VLAN setting screen, for example, the setting contents of the port-based VLAN and the tag VLAN, and then has a network device having a port specified on the VLAN setting screen. 30. Thereby, the editing of the VLAN setting corresponding to the setting input received via the GUI component of the VLAN setting screen is realized.

[Process flow]
6 and 7 are flowcharts illustrating the procedure of the control process according to the first embodiment. As an example, this process is started when a setting input related to the VLAN is received via the GUI component of the VLAN setting screen. Here, for convenience of explanation, a case where a setting input for one port is accepted is illustrated. However, when setting inputs for a plurality of ports are accepted, the control processing shown in FIGS. 6 and 7 accepts a setting input. It is executed for each specified port.

As shown in FIG. 6, when the setting input related to the VLAN is received by the receiving unit 15c (step S101), the determination unit 15d refers to the field of the operation mode included in the port information 13a2 to thereby determine the VLAN related in step S101. It is determined whether or not the port for which the setting input has been accepted is an “authentication port” (step S102).

Here, when the port for which the setting input related to the VLAN is received is the “authentication port” (Yes in step S102), the setting control unit 15e regulates the setting input and outputs an alert for warning the setting input for the authentication port. (Step S103 and Step S104), and the process is terminated.

On the other hand, when the port for which the setting input has been accepted is not the “authentication port” (No in step S102), the determination unit 15d acquires the VLAN ID list of the authentication VLAN (step S105). Then, the determination unit 15d further determines whether there is a VLAN ID that matches the VLAN ID included in the VLAN ID list of the authentication VLAN among the VLAN IDs specified by the setting input (step S106).

At this time, if there is a VLAN ID that matches the VLAN ID included in the VLAN ID list of the authentication VLAN among the VLAN IDs specified by the setting input (Yes in step S106), the setting control unit 15e executes the following process To do. That is, the setting control unit 15e regulates the setting input accepted in step S101 and outputs an alert warning that the VLAN ID assigned to the authentication port is used (step S107 and step S108), and ends the process. .

On the other hand, if there is no VLAN ID that matches the VLAN ID included in the VLAN ID list of the authentication VLAN among the VLAN IDs specified by the setting input (No in step S106), the setting control unit 15e permits the setting input (step S106). S109). That is, the setting control unit 15e generates a command corresponding to the contents set and input on the VLAN setting screen, for example, the setting contents of the port-based VLAN and the tag VLAN, and then has a network device having a port specified on the VLAN setting screen. By transmitting to 30, the VLAN setting editing corresponding to the setting input received via the GUI component of the VLAN setting screen is realized. Thereafter, the process ends.

As described above, the network management apparatus 10 according to this embodiment controls whether or not to restrict setting input depending on whether or not the port that has received the setting input related to the VLAN is a port in which the authentication VLAN is set. To do. Therefore, according to the network management apparatus 10 according to the present embodiment, it is possible to suppress overwriting of the setting for the port for which the authentication VLAN is set.

Now, although the embodiments related to the disclosed device have been described so far, the present invention may be implemented in various different forms other than the above-described embodiments. Therefore, another embodiment included in the present invention will be described below.

For example, in the above-described first embodiment, the case where the setting input for the authentication port is canceled and then canceled is illustrated. However, the setting input may not necessarily be received, and the setting may be restricted before the setting input is received. FIG. 8 is a diagram illustrating an example of the VLAN setting screen. As shown in FIG. 8, in the port of the interface name “Ethernet (registered trademark) 1/0/10” on the VLAN setting screen 600, unlike the display of other ports, the operation mode, port-based VLAN, tag VLAN and dynamic VLAN are displayed. The GUI component that edits the ID is masked. For this reason, unlike the ports of the interface names “Ethernet (registered trademark) 1/0/1” to “Ethernet (registered trademark) 1/0/9”, the operation for the GUI component itself is restricted. Therefore, since acceptance of setting input to the authentication port can be restricted, it is possible to suppress overwriting of setting for the port in which the authentication VLAN is set, as in the first embodiment.

[Distribution and integration]
In addition, each component of each illustrated apparatus does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the collection unit 15a, the display control unit 15b, the reception unit 15c, the determination unit 15d, or the setting control unit 15e may be connected as an external device of the network management device 10 via a network. In addition, the functions of the network management apparatus 10 described above can be obtained by having the collection unit 15a, the display control unit 15b, the reception unit 15c, the determination unit 15d, or the setting control unit 15e, which are connected to the network and cooperate. May be realized. In addition, another device has all or part of the topology information 13a stored in the storage unit 13, and the functions of the network management device 10 described above are realized by cooperating with a network connection. It doesn't matter.

[Control program]
The various processes described in the above embodiments can be realized by executing a prepared program on a computer such as a personal computer or a workstation. In the following, an example of a computer that executes a control program having the same function as that of the above-described embodiment will be described with reference to FIG.

FIG. 9 is a diagram illustrating a hardware configuration example of a computer that executes a control program according to the first and second embodiments. As illustrated in FIG. 9, the computer 100 includes an operation unit 110 a, a speaker 110 b, a camera 110 c, a display 120, and a communication unit 130. Further, the computer 100 includes a CPU 150, a ROM 160, an HDD 170, and a RAM 180. These units 110 to 180 are connected via a bus 140.

As shown in FIG. 9, the HDD 170 has a control program 170a that exhibits the same functions as those of the collection unit 15a, the display control unit 15b, the reception unit 15c, the determination unit 15d, and the setting control unit 15e described in the first embodiment. Is memorized. This control program 170a may be integrated or separated as with the constituent elements of the collection unit 15a, display control unit 15b, reception unit 15c, determination unit 15d, and setting control unit 15e shown in FIG. That is, the HDD 170 does not necessarily have to store all the data shown in the first embodiment, and data used for processing may be stored in the HDD 170.

Under such an environment, the CPU 150 reads out the control program 170a from the HDD 170 and develops it in the RAM 180. As a result, the control program 170a functions as a control process 180a as shown in FIG. The control process 180a expands various data read from the HDD 170 in an area allocated to the control process 180a in the storage area of the RAM 180, and executes various processes using the expanded various data. For example, as an example of processing executed by the control process 180a, processing shown in FIGS. 6 and 7 and the like are included. Note that the CPU 150 does not necessarily operate all the processing units described in the first embodiment, and the processing unit corresponding to the process to be executed may be virtually realized.

Note that the control program 170a may not necessarily be stored in the HDD 170 or the ROM 160 from the beginning. For example, each program is stored in a “portable physical medium” such as a flexible disk inserted into the computer 100, so-called FD, CD-ROM, DVD disk, magneto-optical disk, or IC card. Then, the computer 100 may acquire and execute each program from these portable physical media. In addition, each program is stored in another computer or server device connected to the computer 100 via a public line, the Internet, a LAN, a WAN, etc., and the computer 100 acquires and executes each program from these. It may be.

DESCRIPTION OF SYMBOLS 1 Network management system 3 Monitored system 10 Network management apparatus 11 Communication I / F part 13 Memory | storage part 13a Topology information 15 Control part 15a Collection part 15b Display control part

15c Reception part

15d Determination part 15e Setting control part 20

Authentication server

30A, 30B ,

30C Network device

40A, 40B, 40C User terminal 50 Client terminal

Claims

When a setting input is received for a port of a device included in the network to be monitored, it is determined whether an authentication VLAN with an authentication function is set for the port;
If it is determined that an authentication VLAN is set for the port, the setting input is restricted; if it is determined that an authentication VLAN is not set for the port, the setting input is permitted.
A control program for causing a computer to execute processing.
If it is determined that an authentication VLAN is not set for the port, and if it is determined that the received setting input is identification information of an authentication VLAN set for another port, the received setting Restrict input,
The control program according to claim 1, which causes a computer to execute processing.
If it is determined that an authentication VLAN is set for the port, an alert to further restrict the setting input is output.
The control program according to claim 1, which causes a computer to execute processing.
If it is determined that an authentication VLAN is not set for the port, and if it is determined that the received setting input is identification information of an authentication VLAN set for another port, the setting input is further performed. Output an alert to regulate
The control program according to claim 2, which causes a computer to execute processing.
When a setting input is received for a port of a device included in the network to be monitored, it is determined whether an authentication VLAN with an authentication function is set for the port;
If it is determined that an authentication VLAN is set for the port, the setting input is restricted; if it is determined that an authentication VLAN is not set for the port, the setting input is permitted.
A control method characterized in that a computer executes a process.
If it is determined that an authentication VLAN is not set for the port, and if it is determined that the received setting input is identification information of an authentication VLAN set for another port, the received setting Restrict input,
The control method according to claim 5, wherein the processing is executed by a computer.
If it is determined that an authentication VLAN is set for the port, an alert to further restrict the setting input is output.
The control method according to claim 5, wherein the processing is executed by a computer.
If it is determined that an authentication VLAN is not set for the port, and if it is determined that the received setting input is identification information of an authentication VLAN set for another port, the setting input is further performed. Output an alert to regulate
The control method according to claim 6, wherein the process is executed by a computer.
A determination unit that determines whether an authentication VLAN with an authentication function is set for the port when a setting input is received for a port of a device included in the network to be monitored;
A setting control unit that restricts the setting input when it is determined that an authentication VLAN is set for the port, and permits the setting input when it is determined that the authentication VLAN is not set for the port. When,
A control device comprising:
The setting control unit determines that the authentication VLAN is not set for the port, and determines that the received setting input is identification information of the authentication VLAN set for another port. Regulates the accepted setting input,
The control device according to claim 9.
When the setting control unit determines that an authentication VLAN is set for the port, the setting control unit further outputs an alert to restrict the setting input.
The control device according to claim 9.
The setting control unit determines that the authentication VLAN is not set for the port, and determines that the received setting input is identification information of the authentication VLAN set for another port. Further outputs an alert to restrict the setting input,
The control device according to claim 10.