WO2021103986A1 - 一种网络设备管理方法、装置、网络管理设备及介质 - Google Patents

一种网络设备管理方法、装置、网络管理设备及介质 Download PDF

Info

Publication number
WO2021103986A1
WO2021103986A1 PCT/CN2020/127222 CN2020127222W WO2021103986A1 WO 2021103986 A1 WO2021103986 A1 WO 2021103986A1 CN 2020127222 W CN2020127222 W CN 2020127222W WO 2021103986 A1 WO2021103986 A1 WO 2021103986A1
Authority
WO
WIPO (PCT)
Prior art keywords
network device
network
address
configuration information
management
Prior art date
Application number
PCT/CN2020/127222
Other languages
English (en)
French (fr)
Inventor
杨艳
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP20891617.1A priority Critical patent/EP4064745A4/en
Publication of WO2021103986A1 publication Critical patent/WO2021103986A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/26—Network addressing or numbering for mobility support
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity

Definitions

  • the present disclosure relates to wireless communication networks, and in particular, to a network equipment management method, device, network management equipment, and media.
  • the network management device can manage various network devices, which has high requirements for management efficiency. For example, the server and each network device obtain the physical interface address or the transfer gateway interface address through the message carrying custom attributes, and the obtained interface address can be used to establish the connection between the server and each network device, and the server manages through these interface addresses Internet equipment. If custom attributes or transit gateways are changed, the interface address of the management network device will also change, which is not conducive to the unified management of the network device by the server, and the management efficiency and stability are poor.
  • the present disclosure provides a network equipment management method, device, network management equipment and medium, which manage the network equipment through a fixed interface address, thereby improving management efficiency and management stability.
  • the embodiment of the present disclosure provides a network device management method, including: receiving an online authentication request of the network device and authenticating the network device; in the case of passing the authentication, creating a loopback interface of the network device according to pre-configuration information And assign a loopback interface address, the pre-configuration information includes a loopback interface address pool and a first address allocation rule; and manage the network device through the loopback interface address.
  • the embodiment of the present disclosure also provides a network device management device, including: an authentication module configured to receive an online authentication request of a network device and authenticate the network device; an interface creation module configured to, if the authentication is passed, Create a loopback interface of the network device and assign a loopback interface address according to pre-configuration information, the pre-configuration information includes a loopback interface address pool and a first address allocation rule; and a management module configured to pass through the loopback interface Address management of the network device.
  • an authentication module configured to receive an online authentication request of a network device and authenticate the network device
  • an interface creation module configured to, if the authentication is passed, Create a loopback interface of the network device and assign a loopback interface address according to pre-configuration information, the pre-configuration information includes a loopback interface address pool and a first address allocation rule
  • a management module configured to pass through the loopback interface Address management of the network device.
  • the embodiment of the present disclosure also provides a network management device, including: one or more controllers; and a storage device for storing one or more programs; wherein, when the one or more programs are used by the one or more A plurality of controllers are executed, so that the one or more controllers implement the above-mentioned network device management method.
  • the embodiment of the present disclosure also provides a computer-readable storage medium, and a computer program is stored on the computer-readable storage medium, and when the program is executed by a controller, the above-mentioned network device management method is implemented.
  • FIG. 1 is a flowchart of a network device management method provided by an embodiment
  • FIG. 2 is a flowchart of a network device management method provided by another embodiment
  • FIG. 3 is a schematic diagram of establishing a management link to a network device according to an embodiment
  • FIG. 4 is a schematic structural diagram of a network device management apparatus provided by an embodiment.
  • Fig. 5 is a schematic diagram of the hardware structure of a network management device provided by an embodiment.
  • the embodiment of the present disclosure provides a network device management method, which manages the network device through a fixed interface address, thereby improving management efficiency and management stability.
  • Fig. 1 is a flowchart of a network device management method provided by an embodiment. This method can be applied to network management equipment. As shown in Figure 1, the method provided in this embodiment includes steps 110-130.
  • step 110 the online authentication request of the network device is received and the network device is authenticated.
  • step 120 if the authentication is passed, a loopback interface of the network device is created and a loopback interface address is allocated according to pre-configuration information, the pre-configuration information includes a loopback interface address pool and a first address allocation rule.
  • step 130 the network device is managed through the loopback interface address.
  • the network device refers to a physical entity that can be connected to the network management device, such as routers, switches, bridges, computers, etc.
  • the network device and the network management device can be connected through wired or wireless connections.
  • the network management equipment can manage, maintain and monitor each network equipment in the network, report and deal with the failure of the network equipment in time, so as to coordinate the efficient operation of the network.
  • the network management device authenticates the network device after receiving the online authentication request of the network device. If the authentication is passed, it establishes a network configuration protocol (The Network Configuration Protocol, NETCONF) link, and creates a network based on the pre-configuration information
  • the loopback interface of the device is assigned a loopback interface address, and the loopback interface address is used as a fixed interface address for managing the network device.
  • the pre-configuration information includes the loopback interface address pool and the first address allocation rule.
  • the network management device allocates one from the loopback interface address pool to the authenticated network management device according to the first address allocation rule, where the first address allocation rule It can assign a loopback interface address to a network device according to the Dynamic Host Configuration Protocol (DHCP); it can also assign a loopback interface address to the network device after the first online authentication of the network device, and then it can be used for fixed use after going online again The same address; it is also possible to assign a specific loopback interface address according to the device ID and device serial number of the network device.
  • DHCP Dynamic Host Configuration Protocol
  • the network management device can create the network device as a network element within its management range, and return the network element status to be normal (the network device status is online), and the management address is Based on the assigned loopback interface address, the network management device can manage the network device through the fixed loopback interface address.
  • the pre-configuration information further includes a security management channel interface address pool and a second address allocation rule; after allocating the loopback interface address, it also includes: creating network devices and corresponding gateway network elements respectively according to the pre-configuration information Security management channel and assign the security management channel interface address.
  • Manage network equipment through loopback interface address including: manage network equipment through security management channel and loopback interface address.
  • the pre-configuration information further includes the security management channel interface address pool and the second address allocation rule.
  • the network management device After the NETCONF link is established with the network device, in addition to assigning the loopback interface address, the network management device will also determine whether the network device needs to be managed through the security management channel according to the pre-configuration information (whether the security management channel is enabled), if so, then Create a security management channel for the network device and the corresponding gateway network element, and assign the security management channel interface address according to the second address allocation rule. On this basis, the network management device can be managed through the security management channel through the gateway network element to the network device Internet equipment.
  • the gateway network element refers to the network element directly connected to the network management device, which plays a forwarding role in the communication process between the network management device and other network elements (various network devices that establish links), and can connect the network management device to other network elements.
  • the network addresses of the network elements are separated, and the two ends do not affect each other, thereby improving the security of management.
  • the second address allocation rule may be to create different types of security management channels between the network device and the gateway network element and allocate interface addresses according to the device identification, device serial number, etc. of the network device in combination with specific application scenarios. If the network device does not need a secure management channel, the network management device can directly manage the network device through the address issued when the NETCONF link is established.
  • the network management device determines whether the security management channel of the network device is enabled, and if so, it issues the Internet Protocol Security (IPSEC) secure encrypted tunnel configuration through the established NETCONF link, thereby creating security management aisle.
  • IPSEC Internet Protocol Security
  • This process specifically includes: After the network management device creates the loopback interface and assigns the loopback interface address, it creates an IPSEC secure encrypted tunnel between the network device and the corresponding gateway network element, and assigns the tunnel interface address.
  • the configuration mode of the IPSEC secure encrypted tunnel is static, that is, the local end of the IPSEC secure encrypted tunnel is the Wide Area Network (WAN) interface name, and the opposite end is the WAN interface address corresponding to the gateway network element.
  • WAN Wide Area Network
  • the opposite end is the translated address configured by NAT;
  • the IPSEC secure encrypted tunnel configuration mode is dynamic, that is ,
  • the local end of the IPSEC secure encrypted tunnel is the WAN interface address, and the opposite end is not configured.
  • the IPSEC security encryption tunnel interface address of the network equipment and the gateway network element can be allocated from the security management channel address pool in the pre-configuration information, for example, a 30-bit mask and 2 addresses can be issued from the security management channel address pool.
  • the method further includes: issuing a first static route to the network device, the destination address of the first static route is the WAN port address, and the next hop is the security management channel interface address of the gateway network element; downloading to the gateway network element Send a second static route, the destination address of the second static route is the loopback interface address of the network device, and the next hop is the security management channel interface address of the network device.
  • the network management device issues a static route from the network device to the network management device, where the destination address is the controller management address, and the next hop is the IPSEC secure encrypted tunnel interface address on the gateway network element;
  • the network management device also issues a static route from the gateway device to the network device, where the destination address is the loopback interface address of the network device, and the next hop is the interface address of the IPSEC secure encrypted tunnel on the network device.
  • the pre-configuration information further includes: WAN port address information, a network device identification information table, and a network device service configuration information table; wherein, the WAN port address information includes: a WAN port address pool and a third address allocation rule; network The device identification information table includes: the device serial number and device type corresponding to the network device; the network device service configuration information table includes: the device serial number corresponding to the network device, WAN port address, communication mode, online authentication address and port, authentication key, Network configuration enable state and security management channel enable state.
  • the network management device pre-configures various types of address information, for example:
  • Configure the WAN port address pool (the device online address pool can also be used) to allocate the WAN port address for the network device requesting to go online, and configure the corresponding third address allocation rule;
  • Configure the security management channel interface address pool which is used to allocate the security management channel interface address during the process of creating the security management channel for the network device and the gateway device, and you can configure the second address allocation rule.
  • the network management device also imports the deployment network device identification information table during the pre-configuration process.
  • the deployment network device identification information table can include the network device manufacturer, device serial number, device type, remarks, etc.
  • the deployment network device identification information table is imported into the network management device in the form of a configuration file, and the network management device will import data Write to the database.
  • the device serial number is the unique identification of the network device.
  • the device serial numbers of different network devices are different and have been set before the device leaves the factory.
  • the network device may be a high-end router, or may be a wireless device such as Customer Premise Equipment (CPE), and any network device with a unique identifier may be managed by the method of this embodiment.
  • CPE Customer Premise Equipment
  • the network management device judges according to the device type and/or manufacturer, and only the information of the preset device type and/or manufacturer can be imported successfully, that is, the network management device can only Manage the network equipment that conforms to the preset device type and/or manufacturer.
  • the network management device also imports the network device service configuration information table during the pre-configuration process.
  • the network equipment service configuration information table includes the pre-planned service configuration information required for the network equipment to go online, such as the equipment serial number of the network equipment, the address of the WAN port (the interface for the network equipment to connect to the network), the communication method (mailbox configuration, telephone, etc.), Online authentication (CALL HOME) address and port, authentication key, network configuration (NETCONF) enable status, and security management channel enable status.
  • the WAN port address is allocated from the WAN port address pool in the address information, and the allocation rule can be DHCP static or dynamic allocation;
  • the authentication key is used to verify the security of the network device when it initiates an online request, and is received by the user of the network device To email or SMS, click on the Uniform Resource Locator (URL) link given in the email or SMS, and you will receive a prompt to enter the password.
  • the password is the authentication key, which is sent to The user is a necessary verification method for the online configuration of network equipment.
  • the authentication key can be issued to the user of the network device by email or SMS, or pre-issued with the network device;
  • the CALL HOME address is the address of the network management device (controller), and the CALL HOME port is created by the network device and the network management device The port used for Transmission Control Protocol (TCP) connection.
  • TCP Transmission Control Protocol
  • the network equipment service configuration information table is imported into the network management equipment in the form of a configuration file, and the network management equipment writes the imported data into the database.
  • the network management device determines whether the device serial number is consistent with the device serial number in the imported deployment network device identification information table. In the case of consistency, the network device service configuration information The table is imported successfully.
  • the method before receiving the online authentication request of the network device, the method further includes: issuing a URL to the network device according to a communication mode, the URL being encrypted by an authentication key; wherein the URL link carries online configuration information,
  • the online configuration information includes the WAN port address, the CALL HOME address and port, and the network configuration enable state; when the security management channel enable state is on, the online configuration information also includes the security management channel interface of the corresponding gateway network element address.
  • the network management device sends online configuration information to the network device via email or short message.
  • the online configuration information is contained in the URL encrypted by the authentication key.
  • the user of the network device can obtain the online configuration information by clicking the link in the email or SMS and entering the authentication key.
  • Online configuration information includes configuration information necessary for online authentication, such as WAN port address (mask and gateway address), CALL HOME address and port, and network configuration enable status.
  • the interface decrypts the configuration to be sent, and assigns it according to the configuration
  • the WAN port is connected to the network, click to release the configuration, the online configuration information can be successfully sent to the network device.
  • the online authentication request is sent by the network device to the CALL HOME address in the form of a TCP session via the CALL HOME port; the online authentication request carries the device sequence of the network device Number and Transport Layer Security (TLS) certificate.
  • TLS Transport Layer Security
  • the network device after the network device receives the URL and enables NETCONF, it can initiate online authentication to the network management device through the WAN port, and the destination address is the CALL HOME address in the online configuration information.
  • the network device carries the device serial number and sends an online authentication request (TCP request) in the form of a transmission control protocol TCP session; after receiving the online authentication request, the network management device determines whether the device serial number belongs to the device serial number in the pre-configured information If yes, then send the TLS session request to the network device; if not, then the TCP session is terminated.
  • TCP request online authentication request
  • authenticating the network device includes: if the device serial number of the network device belongs to the device serial number in the pre-configured information, verifying the TLS certificate of the network device, and if the TLS certificate verification is passed, Start the network configuration protocol, and the authentication is passed; if the device serial number of the network device does not belong to the device serial number in the pre-configuration information, the TCP session is terminated and the authentication fails.
  • the network device sends a TCP request carrying a TLS certificate to the network management device, and the network management device verifies the TLS certificate provided by the network device.
  • the verification can be done through the certificate path, or by combining the TLS certificate (or host key) with The previously trusted or fixed value is compared to complete. If the TLS certificate is a trusted valid certificate, the TLS connection is established, which means that the NETCONF protocol is successfully initiated between the network management device and the network device, that is, the NETCONF link establishment is successful. After the NETCONF link is successfully established, the network management device assigns the loopback interface address as a fixed management address, and can further determine whether it needs to be managed through a secure channel according to the pre-configured information.
  • the network management device uses the LOOPBACK21 address as a fixed management address to create the network element of the network device, and can manage the network device through the management address and the IPSEC security tunnel.
  • the network management device returns the link establishment status of the network device to be online.
  • Fig. 2 is a flowchart of a network device management method provided by another embodiment, as shown in Fig. 2:
  • a uniform resource locator is issued to the network device according to the communication mode in the pre-configuration information, and the uniform resource locator is encrypted by an authentication key.
  • step 220 an online authentication request of a network device is received, and the online authentication request carries the device serial number and TLS certificate of the network device.
  • step 230 does the device serial number of the network device belong to the device serial number in the pre-configuration information? If yes, go to step 240; if no, then authentication fails.
  • step 220 in the case of authentication failure, step 220 is returned to and the online authentication request is received again.
  • step 240 the transport layer security protocol TLS certificate of the network device is verified.
  • step 250 if the authentication is passed, the loopback interface of the network device is created according to the pre-configuration information and the loopback interface address is allocated.
  • step 260 the security management channels of the network device and the corresponding gateway network element are respectively created according to the pre-configuration information, and the security management channel interface addresses are allocated.
  • a first static route is delivered to the network device, the destination address of the first static route is the WAN port address, and the next hop is the security management channel interface address of the gateway network element.
  • step 280 a second static route is issued to the gateway network element, the destination address of the second static route is the loopback interface address of the network device, and the next hop is the security management channel of the network device interface address.
  • step 290 the network device is managed through the security management channel and the loopback interface address.
  • Fig. 3 is a schematic diagram of establishing a management link to a network device according to an embodiment.
  • the controller configuration management module and the controller service processing module belong to the management unit in the network management device.
  • the controller configuration management module is used to pre-configure, issue online configuration information, and update the online status of the network device.
  • the controller The service processing module is used to process services such as interface creation, channel creation, and routing configuration of network equipment and gateway network elements. As shown in Figure 3, the process of establishing a management link for network devices is as follows:
  • the controller configuration management module imports the deployment device identification information table
  • the controller configuration management module imports the network equipment business configuration information table
  • the service processing module of the controller sends a URL to the network device, and the URL carries the online configuration information
  • the network device initiates a CALL HOME request to the service processing module of the controller
  • the controller business processing module authenticates the CALL HOME request (taking the authentication as an example);
  • the controller business processing module creates a loopback interface and assigns the loopback interface address
  • the controller business processing module creates the security management channel of the network equipment and assigns the security management channel interface address
  • the controller service processing module creates the security management channel of the corresponding gateway network element and assigns the security management channel interface address
  • the controller service processing module configures the static route from the network device to the server
  • the controller service processing module configures a static route from the gateway network element to the network device
  • the controller service processing module creates the network element of the network device, and the chain is successfully established.
  • the controller service processing module returns to the controller configuration management module that the link is successfully established and the network device is online.
  • the network device management method of this embodiment manages network devices through a fixed loopback interface address to improve management stability; and can manage network devices through a secure management channel to improve management security; in addition, by issuing online configuration information , Verify the device serial number and TLS certificate, issue static routes, etc., establish the link between the network management device, the network device and the corresponding gateway network element, thus establish a complete management mechanism, and comprehensively manage the network device.
  • Fig. 4 is a schematic structural diagram of a network device management apparatus provided by an embodiment. As shown in FIG. 4, the network device management apparatus includes: an authentication module 410, an interface creation module 420, and a management module 430.
  • the authentication module 410 is configured to receive an online authentication request from a network device and authenticate the network device;
  • the interface creation module 420 is configured to create a loopback interface of the network device and assign a loopback interface address based on pre-configuration information when the authentication is passed, the pre-configuration information includes the loopback interface address pool and the first address assignment rule;
  • the management module 430 is configured to manage the network device through the loopback interface address.
  • the network equipment management apparatus of this embodiment manages the network equipment through a fixed interface address, which improves management efficiency and management stability.
  • the pre-configuration information further includes a security management channel interface address pool and a second address allocation rule
  • a channel creation module configured to separately create a security management channel for the network device and the corresponding gateway network element according to the pre-configuration information, and assign a security management channel interface address;
  • the managing the network device through the loopback interface address includes:
  • the network device is managed through the security management channel and the loopback interface address.
  • it further includes:
  • the first route issuing module is configured to issue a first static route to the network device, the destination address of the first static route is the WAN port address, and the next hop is the security management channel interface address of the gateway network element ;
  • the second route issuing module is configured to issue a second static route to the gateway network element, the destination address of the second static route is the loopback interface address of the network device, and the next hop is the network device The address of the security management channel interface.
  • the pre-configuration information also includes: WAN port address information, network device identification information table, and network device service configuration information table; among them,
  • the WAN port address information includes: a WAN port address pool and a third address allocation rule
  • the network equipment identification information table includes: equipment serial numbers and equipment types corresponding to the network equipment;
  • the network device service configuration information table includes: device serial number, WAN port address, communication mode, online authentication address and port, authentication key, network configuration enable state, and security management channel enable state corresponding to the network device.
  • it further includes:
  • the URL issuing module is configured to issue a uniform resource locator to the network device according to the communication mode before receiving the online authentication request of the network device, and the uniform resource locator is encrypted by the authentication key;
  • the uniform resource locator carries online configuration information
  • the online configuration information includes a WAN port address, an online authentication address and port, and a network configuration enable state
  • the online configuration information further includes the security management channel interface address of the corresponding gateway network element.
  • the online authentication request is sent by the network device in the form of a transmission control protocol TCP session to the online authentication address through an online authentication port;
  • the online authentication request carries the device serial number and TLS certificate of the network device.
  • the authentication module 410 is specifically configured as follows:
  • the transport layer security protocol TLS certificate of the network device is verified, and the network configuration protocol is started when the TLS certificate is verified, and the authentication by;
  • the TCP session is terminated and the authentication fails.
  • the network equipment management apparatus proposed in this embodiment and the network equipment management method proposed in the above embodiments belong to the same inventive concept.
  • this embodiment has and executes the network The equipment management method has the same beneficial effect.
  • the embodiment of the present disclosure also provides a network management device.
  • the network equipment management method may be executed by a network equipment management apparatus, which may be implemented in software and/or hardware, and integrated in the network management equipment.
  • Fig. 5 is a schematic diagram of the hardware structure of a network management device provided by an embodiment.
  • a network management device provided by this embodiment includes: a controller 510 and a storage device 520. There may be one or more controllers in the network management device.
  • one controller 510 is taken as an example.
  • the controller 510 and the storage device 520 in the device may be connected by a bus or other methods. In FIG. Take the bus connection as an example.
  • the one or more programs are executed by the one or more controllers 510, so that the one or more controllers implement the network device management method described in any of the foregoing embodiments.
  • the storage device 520 in the network management device is used as a computer-readable storage medium and can be used to store one or more programs.
  • the programs can be software programs, computer-executable programs, and modules, such as the network device in the embodiment of the present invention.
  • the program instructions/modules corresponding to the management method include: an authentication module 410, an interface creation module 420, and a management module 430).
  • the controller 510 executes various functional applications and data processing of the network management device by running the software programs, instructions, and modules stored in the storage device 520, that is, implements the network device management method in the foregoing method embodiment.
  • the storage device 520 mainly includes a storage program area and a storage data area.
  • the storage program area can store an operating system and an application program required by at least one function; the storage data area can store data created according to the use of the device, etc. (as in the above implementation) The online authentication request, pre-configuration information, etc. in the example).
  • the storage device 520 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices.
  • the storage device 520 may further include memories remotely provided with respect to the controller 510, and these remote memories may be connected to a network management device through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the following operations are implemented: receiving the online authentication request of the network device and authenticating the network device; In the case of passing, the loopback interface of the network device is created and the loopback interface address is allocated according to the pre-configuration information, the pre-configuration information includes the loopback interface address pool and the first address allocation rule; the loopback interface address is passed Manage the network equipment.
  • the network management device proposed in this embodiment and the network device management method proposed in the above embodiment belong to the same inventive concept.
  • the embodiments of the present disclosure also provide a storage medium containing computer-executable instructions, and the computer-executable instructions are used to execute a network device management method when executed by a computer controller.
  • the present disclosure can be implemented by software and general-purpose hardware, and can also be implemented by hardware.
  • the technical solution of the present disclosure can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, a read-only memory (ROM), Random Access Memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute any of the disclosures The method described in the embodiment.
  • the block diagram of any logic flow in the drawings of the present disclosure may represent program steps, or may represent interconnected logic circuits, modules, and functions, or may represent a combination of program steps and logic circuits, modules, and functions.
  • the computer program can be stored on the memory.
  • the memory can be of any type suitable for the local technical environment and can be implemented using any suitable data storage technology, such as but not limited to read-only memory (ROM), random access memory (RAM), optical storage devices and systems (digital multi-function optical discs) DVD or CD) etc.
  • Computer-readable media may include non-transitory storage media.
  • the data controller can be any type suitable for the local technical environment, such as but not limited to general-purpose computers, special-purpose computers, microcontrollers, digital signal controllers (DSP), application-specific integrated circuits (ASIC), programmable logic devices (FGPA) And the controller based on the multi-core controller architecture.
  • DSP digital signal controllers
  • ASIC application-specific integrated circuits
  • FGPA programmable logic devices

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种网络设备管理方法、装置、网络管理设备及介质。该方法接收网络设备的上线认证请求并对所述网络设备进行认证(S110)；在认证通过的情况下，根据预配置信息创建所述网络设备的环回接口并分配环回接口地址，所述预配置信息包括环回接口地址池以及第一地址分配规则(S120)；以及通过所述环回接口地址管理所述网络设备(S130)。

Description

一种网络设备管理方法、装置、网络管理设备及介质
相关申请的交叉引用
本申请基于申请号为201911198866.7、申请日为2019年11月29日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本公开涉及无线通信网络，特别是涉及一种网络设备管理方法、装置、网络管理设备及介质。
背景技术
在大规模网络业务部署场景中，各种各样的网络设备分布在不同区域，分布密集且数量庞大。网络管理设备可以对各种网络设备进行管理，对管理效率的要求很高。例如，服务器和各网络设备之间通过报文携带自定义的属性获取物理接口地址或者中转网关接口地址等，使用获取到的接口地址可以建立服务器与各网络设备的连接，服务器通过这些接口地址管理网络设备。如果自定义的属性或中转网关等发生变动，管理网络设备的接口地址也会发生变化，不利于服务器对网络设备的统一管理，管理效率和稳定性较差。
发明内容
本公开提供一种网络设备管理方法、装置、网络管理设备及介质，通过固定的接口地址管理网络设备，提高管理效率和管理的稳定性。
本公开实施例提供一种网络设备管理方法，包括：接收网络设备的上线认证请求并对所述网络设备进行认证；在认证通过的情况下，根据预配置信息创建所述网络设备的环回接口并分配环回接口地址，所述预配置信息包括环回接口地址池以及第一地址分配规则；以及，通过所述环回接口地址管理所述网络设备。
本公开实施例还提供了一种网络设备管理装置，包括：认证模块，设置为接收网络设备的上线认证请求并对所述网络设备进行认证；接口创建模块，设置为在认证通过的情况下，根据预配置信息创建所述网络设备的环回接口并分配环回接口地址，所述预配置信息包括环回接口地址池以及第一地址分配规则；以及管理模块，设置为通过所述环回接口地址管理所述网络设备。
本公开实施例还提供了一种网络管理设备，包括：一个或多个控制器；以及存储装置，用于存储一个或多个程序；其中，当所述一个或多个程序被所述一个或多个控制器执行， 使得所述一个或多个控制器实现上述的网络设备管理方法。
本公开实施例还提供了一种计算机可读存储介质，计算机可读存储介质上存储有计算机程序，该程序被控制器执行时实现上述的网络设备管理方法。
附图说明
此处所说明的附图用来提供对本公开的进一步理解，构成本公开的一部分，本公开的示意性实施例及其说明用于解释本公开，并不构成对本公开的不当限定。在附图中：
图1为一实施例提供的一种网络设备管理方法的流程图；
图2为另一实施例提供的一种网络设备管理方法的流程图；
图3为一实施例提供的建立对网络设备的管理链接的示意图；
图4为一实施例提供的一种网络设备管理装置的结构示意图；以及
图5为一实施例提供的一种网络管理设备的硬件结构示意图。
具体实施方式
下面结合附图和实施例对本公开进行说明。可以理解的是，此处所描述的具体实施例仅仅用于解释本公开，而非对本公开的限定。需要说明的是，在不冲突的情况下，本公开中的实施例及实施例中的特征可以相互任意组合。另外还需要说明的是，为了便于描述，附图中仅示出了与本公开相关的部分而非全部结构。
在本公开实施例提供一种网络设备管理方法，通过固定的接口地址管理网络设备，提高管理效率和管理的稳定性。
图1为一实施例提供的一种网络设备管理方法的流程图。该方法可应用于网络管理设备。如图1所示，本实施例提供的方法包括步骤110-130。
在步骤110中，接收网络设备的上线认证请求并对所述网络设备进行认证。
在步骤120中，在认证通过的情况下，根据预配置信息创建所述网络设备的环回接口并分配环回接口地址，所述预配置信息包括环回接口地址池以及第一地址分配规则。
在步骤130中，通过所述环回接口地址管理所述网络设备。
本实施例中，网络设备指可连接到网络管理设备的物理实体，例如路由器、交换机、网桥、计算机等，网络设备与网络管理设备之间可以通过有线连接，也可以无线连接。网络管理设备作为管理中心，可以对网络中的各网络设备进行管理、维护和监控，在网络设备出现故障时及时报告和处理，从而协调网络的高效运行。
本实施例中，网络管理设备在接收到网络设备的上线认证请求后，对网络设备进行认证，如果认证通过，则建立网络配置协议(The Network Configuration Protocol，NETCONF)链接，根据预配置信息创建网络设备的环回(LOOPBACK)接口并分配环回接口地址，该环 回接口地址即作为对所述网络设备进行管理的固定接口地址。预配置信息中包括环回接口地址池以及第一地址分配规则，网络管理设备依据第一地址分配规则从环回接口地址池中分配一个给通过认证的网络管理设备，其中，第一地址分配规则可以为依据动态主机配置协议(Dynamic Host Configuration Protocol，DHCP)向网络设备分配环回接口地址；还可以在网络设备首次上线认证通过后为其分配一个环回接口地址、之后再次上线即可固定使用相同的地址；也可以根据网络设备的设备标识、设备序列号等分配特定的环回接口地址。在环回接口地址分配结束后，网络管理设备即可将该网络设备创建为其管理范围内的网元，并返回该网元的状态为正常(该网络设备的状态为在线)、管理地址为所分配的环回接口地址，在此基础上，网络管理设备即可通过固定的环回接口地址管理该网络设备。
在一实施例中，预配置信息还包括安全管理通道接口地址池以及第二地址分配规则；在分配环回接口地址之后，还包括：根据预配置信息分别创建网络设备和对应的网关网元的安全管理通道并分配安全管理通道接口地址。通过环回接口地址管理网络设备，包括：通过安全管理通道和环回接口地址管理网络设备。
本实施例中，预配置信息还包括安全管理通道接口地址池以及第二地址分配规则。在与网络设备建立NETCONF链接后，除了分配环回接口地址，网络管理设备还会根据预配置信息判断该网络设备是否需要通过安全管理通道进行管理(安全管理通道是否使能)，如果是，则创建网络设备和对应的网关网元的安全管理通道，并根据第二地址分配规则分配安全管理通道接口地址，在此基础上，网络管理设备可以通过经由网关网元至网络设备的安全管理通道管理网络设备。其中，网关网元是指与网络管理设备直接相连的网元，在网络管理设备与其它网元(建立链接的各种网络设备)通信的过程中起到转发作用，可以将网络管理设备与其它网元的网络地址分割开，两端互不影响，从而提高管理的安全性。第二地址分配规则可以是根据网络设备的设备标识、设备序列号等，结合具体的应用场景，在网络设备和网关网元之间创建不同类型的安全管理通道并分配接口地址。如果网络设备不需要安全管理通道，则网络管理设备直接通过建立NETCONF链接时下发的地址管理网络设备即可。
在一实施例中，网络管理设备判断网络设备的安全管理通道是否使能，如果是，则通过建立的NETCONF链接下发互联网安全协议(Internet Protocol Security，IPSEC)安全加密隧道配置，从而创建安全管理通道。该过程具体包括：网络管理设备创建环回接口并分配环回接口地址后，分别在网络设备和对应的网关网元之间创建IPSEC安全加密隧道，并分配隧道接口地址，其中，对于网络设备，IPSEC安全加密隧道的配置模式为静态，即，IPSEC安全加密隧道的本端为广域网(Wide Area Network，WAN)接口名称，对端为网关 网元对应的WAN接口地址，且在预配置信息(网络设备业务配置信息表)中配置了网络地址转换(Network Address Translation，NAT)的情况下，对端为NAT所配置的转换后的地址；对于网关网元，IPSEC安全加密隧道配置模式为动态，即，IPSEC安全加密隧道的本端为WAN接口地址，对端不配置。网络设备和网关网元的IPSEC安全加密隧道接口地址，可以从预配置信息中的安全管理通道地址池中分配，例如在安全管理通道地址池中取30位掩码2个地址下发。
在一实施例中，还包括：向网络设备下发第一静态路由，第一静态路由的目的地址为WAN端口地址，下一跳为网关网元的安全管理通道接口地址；向网关网元下发第二静态路由，第二静态路由的目的地址为网络设备的环回接口地址，下一跳为网络设备的安全管理通道接口地址。
本实施例中，在建立NETCONF链接后，网络管理设备下发网络设备到网络管理设备的静态路由，其中目的地址为控制器管理地址，下一跳为网关网元上IPSEC安全加密隧道接口地址；网络管理设备还下发网关设备到网络设备的静态路由，其中，目的地址为网络设备的环回接口地址，下一跳为网络设备上IPSEC安全加密隧道的接口地址。
在一实施例中，预配置信息还包括：WAN端口地址信息、网络设备标识信息表和网络设备业务配置信息表；其中，WAN端口地址信息包括：WAN端口地址池以及第三地址分配规则；网络设备标识信息表包括：网络设备对应的设备序列号和设备类型；网络设备业务配置信息表包括：网络设备对应的设备序列号、WAN端口地址、通信方式、上线认证地址和端口、认证密钥、网络配置使能状态和安全管理通道使能状态。
本实施例中，网络管理设备对各类地址信息进行预配置，例如：
配置环回接口地址池，用于为网络设备分配环回接口地址，并配置第一地址分配规则(例如配置使用网络设备的LOOPBACK21接口地址作为固定的管理地址或根据实际使用情况设置任意的LOOPBACK接口地址为管理地址等)；
配置WAN端口地址池(也可为设备上线地址池)，用于为请求上线的网络设备分配WAN端口地址，并配置对应的第三地址分配规则；
配置安全管理通道接口地址池，用于在为网络设备与网关设备创建安全管理通道的过程中分配安全管理通道接口地址，可以配置第二地址分配规则。
网络管理设备在预配置过程中还导入开局网络设备标识信息表。开局网络设备标识信息表中可以包括网络设备的厂商、设备序列号、设备类型、备注字段等，开局网络设备标识信息表以配置文件的形式导入到网络管理设备中，网络管理设备将导入的数据写入数据库。其中，设备序列号是网络设备的唯一标识，不同网络设备的设备序列号不同，在设备 出厂时已设置好。网络设备可以为高端路由器，也可以为客户前置设备(Customer Premise Equipment，CPE)等无线设备，具有唯一标识的网络设备都可以通过本实施例的方法进行管理。
在导入开局网络设备标识信息表的过程中，网络管理设备根据设备类型和/或厂商进行判断，只有符合预设的设备类型和/或厂商的信息才能导入成功，即，网络管理设备只能对符合预设的设备类型和/或厂商的网络设备进行管理。
网络管理设备在预配置过程中还导入网络设备业务配置信息表。网络设备业务配置信息表包括预先规划的网络设备上线需要的业务配置信息，例如网络设备的设备序列号、WAN端口(网络设备上行连接网络的接口)地址、通信方式(邮箱配置、电话等)、上线认证(CALL HOME)地址和端口、认证密钥、网络配置(NETCONF)使能状态和安全管理通道使能状态。其中，WAN端口地址从地址信息中的WAN端口地址池中分配，分配规则可以为DHCP静态也可以为动态分配；认证密钥用于验证网络设备发起上线请求时的安全，在网络设备的用户接收到邮件或者短信、通过点击邮件或短信中给定的统一资源定位符(Uniform Resource Locator，URL)链接，会接收到输入密码的提示信息，该密码即为认证密钥，认证密钥预先发送至用户，是网络设备进行上线配置的必要验证手段。认证密钥可以通过邮件或者短信等方式、或随网络设备一起预先下发给网络设备的用户；CALL HOME地址是网络管理设备(控制器)的地址，CALL HOME端口是网络设备与网络管理设备创建传输控制协议(Transmission Control Protocol，TCP)连接时使用的端口。
网路设备业务配置信息表以配置文件的形式导入到网络管理设备中，网络管理设备将导入的数据写入数据库。在导入网路设备业务配置信息表的过程中，网络管理设备判断其中的设备序列号是否与导入的开局网络设备标识信息表中的设备序列号一致，在一致的情况下，网络设备业务配置信息表导入成功。
在一实施例中，在接收网络设备的上线认证请求之前，还包括：根据通信方式向所述网络设备下发URL，所述URL经过认证密钥加密；其中，URL链接中携带上线配置信息，上线配置信息包括WAN端口地址、CALL HOME地址和端口、网络配置使能状态；在安全管理通道使能状态为开启的情况下，所述上线配置信息还包括对应的网关网元的安全管理通道接口地址。
本实施例中，网络管理设备通过邮件或者短信下发上线配置信息到网络设备。上线配置信息包含在经过认证密钥加密的URL中。网络设备的用户点击邮件或者短信中的链接并输入认证密钥即可获取上线配置信息。上线配置信息包括上线认证所必需的配置信息，例如WAN端口地址(掩码和网关地址)、CALL HOME地址和端口、网络配置使能状态。例如， 用户点击邮件或者短信中的URL链接后，打开网络设备的WEB管理界面，可以根据界面上的提示信息输入预先收到的认证秘钥，界面解密出待下发的配置，根据配置将指定WAN端口连上网络，点击下发配置，上线配置信息即可成功下发到网络设备。
在一实施例中，所述上线认证请求由所述网络设备以传输控制协议TCP会话的形式通过CALL HOME端口发送至所述CALL HOME地址；所述上线认证请求中携带所述网络设备的设备序列号和传输层安全协议(transport layer security，TLS)证书。
本实施例中，网络设备接收到URL、开启NETCONF使能后，可以通过WAN端口向网络管理设备发起上线认证，目的地址是上线配置信息中的CALL HOME地址。首先，网络设备携带设备序列号以传输控制协议TCP会话的形式发送上线认证请求(TCP请求)；网络管理设备收到上线认证请求后，判断该设备序列号是否属于预配置信息中的设备序列号，如果是，则发送到网络设备的TLS会话请求；如果否，则TCP会话中止。
在一实施例中，对所述网络设备进行认证，包括：若网络设备的设备序列号属于预配置信息中的设备序列号，则验证网络设备的TLS证书，并在TLS证书验证通过的情况下启动网络配置协议，认证通过；若网络设备的设备序列号不属于预配置信息中的设备序列号，则终止TCP会话，认证失败。
本实施例中，网络设备发送携带TLS证书的TCP请求到网络管理设备，网络管理设备验证网络设备提供的TLS证书，该验证可以通过证书路径完成，或者通过将TLS证书(或者主机密钥)与先前信任的或固定值进行比较来完成。如果TLS证书是可信任的有效证书，则TLS连接建立，意味着网络管理设备与网路设备之间启动NETCONF协议成功，即，NETCONF建链成功。NETCONF建链成功后，网络管理设备分配环回接口地址作为固定的管理地址，并根据预配置信息可进一步判断是否需要通过安全通道管理，如果是，通过NETCONF链接下发IPSEC安全加密通道配置。例如，网络管理设备使用LOOPBACK21地址作为固定的管理地址创建网络设备的网元，并且可以通过该管理地址和IPSEC安全隧道管理网络设备。网络管理设备返回网络设备建链状态为在线。
图2为另一实施例提供的一种网络设备管理方法的流程图，如图2所示：
在步骤210中，根据预配置信息中的通信方式向所述网络设备下发统一资源定位符，所述统一资源定位符经过认证密钥加密。
在步骤220中，接收网络设备的上线认证请求，所述上线认证请求中携带所述网络设备的设备序列号和TLS证书。
在步骤230中，所述网络设备的设备序列号是否属于预配置信息中的设备序列号？若是，则执行步骤240；若否，则认证失败。
在一实施例中，在认证失败的情况下返回执行步骤220，重新接收上线认证请求。
在步骤240中，验证所述网络设备的传输层安全协议TLS证书。
在步骤250中，在认证通过的情况下，根据预配置信息创建所述网络设备的环回接口并分配环回接口地址。
在步骤260中，根据所述预配置信息分别创建所述网络设备和对应的网关网元的安全管理通道并分配安全管理通道接口地址。
在步骤270中，向所述网络设备下发第一静态路由，所述第一静态路由的目的地址为WAN端口地址，下一跳为所述网关网元的安全管理通道接口地址。
在步骤280中，向所述网关网元下发第二静态路由，所述第二静态路由的目的地址为所述网络设备的环回接口地址，下一跳为所述网络设备的安全管理通道接口地址。
在步骤290中，通过所述安全管理通道和所述环回接口地址管理所述网络设备。
图3为一实施例提供的建立对网络设备的管理链接的示意图。本实施例中，控制器配置管理模块和控制器业务处理模块属于网络管理设备中的管理单元，控制器配置管理模块用于预配置、下发上线配置信息以及更新网络设备的在线状态，控制器业务处理模块用于处理网络设备和网关网元的接口创建、通道创建、配置路由等业务。如图3所示，对网络设备的管理链接的建立过程具体如下：
1.控制器配置管理模块导入开局设备标识信息表；
2.控制器配置管理模块导入网络设备业务配置信息表；
3.控制器业务处理模块向网络设备下发URL，URL中携带上线配置信息；
4.网络设备向控制器业务处理模块发起CALL HOME请求；
5.控制器业务处理模块对CALL HOME请求进行认证(以认证通过为例)；
6.控制器业务处理模块创建环回接口并分配环回接口地址；
7.控制器业务处理模块创建网络设备的安全管理通道并分配安全管理通道接口地址；
8.控制器业务处理模块创建对应的网关网元的安全管理通道并分配安全管理通道接口地址；
9.控制器业务处理模块配置网络设备到服务器的静态路由；
10.控制器业务处理模块配置网关网元到网络设备的静态路由；
11.控制器业务处理模块创建网络设备的网元，建链成功。
12.控制器业务处理模块向控制器配置管理模块返回建链成功，网络设备为在线状态。
本实施例的网络设备管理方法，通过固定的环回接口地址管理网络设备，提高管理的稳定性；并且可以通过安全管理通道管理网络设备，提高管理的安全性；此外，通过下发 上线配置信息、验证设备序列号和TLS证书、下发静态路由等，建立了网络管理设备、网络设备及对应的网关网元之间的链路，从而建立完善的管理机制，全面地管理网络设备。
本公开实施例还提供一种网络设备管理装置。图4为一实施例提供的网络设备管理装置的结构示意图。如图4所示，所述网络设备管理装置包括：认证模块410、接口创建模块420和管理模块430。
认证模块410，设置为接收网络设备的上线认证请求并对所述网络设备进行认证；
接口创建模块420，设置为在认证通过的情况下，根据预配置信息创建所述网络设备的环回接口并分配环回接口地址，所述预配置信息包括环回接口地址池以及第一地址分配规则；
管理模块430，设置为通过所述环回接口地址管理所述网络设备。
本实施例的网络设备管理装置，通过固定的接口地址管理网络设备，提高管理效率和管理的稳定性。
在一实施例中，所述预配置信息还包括安全管理通道接口地址池以及第二地址分配规则；
在分配环回接口地址之后，还包括：
通道创建模块，设置为根据所述预配置信息分别创建所述网络设备和对应的网关网元的安全管理通道并分配安全管理通道接口地址；
所述通过所述环回接口地址管理所述网络设备，包括：
通过所述安全管理通道和所述环回接口地址管理所述网络设备。
在一实施例中，还包括：
第一路由下发模块，设置为向所述网络设备下发第一静态路由，所述第一静态路由的目的地址为WAN端口地址，下一跳为所述网关网元的安全管理通道接口地址；
第二路由下发模块，设置为向所述网关网元下发第二静态路由，所述第二静态路由的目的地址为所述网络设备的环回接口地址，下一跳为所述网络设备的安全管理通道接口地址。
在一实施例中，所述
预配置信息还包括：WAN端口地址信息、网络设备标识信息表和网络设备业务配置信息表；其中，
所述WAN端口地址信息包括：WAN端口地址池以及第三地址分配规则；
所述网络设备标识信息表包括：网络设备对应的设备序列号和设备类型；
所述网络设备业务配置信息表包括：网络设备对应的设备序列号、WAN端口地址、通 信方式、上线认证地址和端口、认证密钥、网络配置使能状态和安全管理通道使能状态。
在一实施例中，还包括：
URL下发模块，设置为在接收网络设备的上线认证请求之前，根据所述通信方式向所述网络设备下发统一资源定位符，所述统一资源定位符经过所述认证密钥加密；
其中，所述统一资源定位符携带上线配置信息，所述上线配置信息包括WAN端口地址、上线认证地址和端口、网络配置使能状态；
在所述安全管理通道使能状态为开启的情况下，所述上线配置信息还包括对应的网关网元的安全管理通道接口地址。
在一实施例中，所述上线认证请求由所述网络设备以传输控制协议TCP会话的形式通过上线认证端口发送至所述上线认证地址；
所述上线认证请求中携带所述网络设备的设备序列号和TLS证书。
在一实施例中，认证模块410，具体设置为：
接收网络设备的上线认证请求；
若所述网络设备的设备序列号属于所述预配置信息中的设备序列号，则验证所述网络设备的传输层安全协议TLS证书，并在TLS证书验证通过的情况下启动网络配置协议，认证通过；
若所述网络设备的设备序列号不属于所述预配置信息中的设备序列号，则终止TCP会话，认证失败。
本实施例提出的网络设备管理装置与上述实施例提出的网络设备管理方法属于同一发明构思，未在本实施例中详尽描述的技术细节可参见上述任意实施例，并且本实施例具备与执行网络设备管理方法相同的有益效果。
本公开实施例还提供一种网络管理设备。所述网络设备管理方法可以由网络设备管理装置执行，该网络设备管理装置可以通过软件和/或硬件的方式实现，并集成在所述网络管理设备中。
图5为一实施例提供的一种网络管理设备的硬件结构示意图。如图5所示，本实施例提供的一种网络管理设备，包括：控制器510和存储装置520。该网络管理设备中的控制器可以是一个或多个，图5中以一个控制器510为例，所述设备中的控制器510和存储装置520可以通过总线或其他方式连接，图5中以通过总线连接为例。
所述一个或多个程序被所述一个或多个控制器510执行，使得所述一个或多个控制器实现上述任一实施例所述的网络设备管理方法。
该网络管理设备中的存储装置520作为一种计算机可读存储介质，可用于存储一个或多个程序，所述程序可以是软件程序、计算机可执行程序以及模块，如本发明实施例中网络设备管理方法对应的程序指令/模块(例如，附图4所示的网络设备管理装置中的模块，包括：认证模块410、接口创建模块420和管理模块430)。控制器510通过运行存储在存储装置520中的软件程序、指令以及模块，从而执行网络管理设备的各种功能应用以及数据处理，即实现上述方法实施例中的网络设备管理方法。
存储装置520主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序；存储数据区可存储根据设备的使用所创建的数据等(如上述实施例中的上线认证请求、预配置信息等)。此外，存储装置520可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实例中，存储装置520可进一步包括相对于控制器510远程设置的存储器，这些远程存储器可以通过网络连接至网络管理设备。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
并且，当上述网络管理设备中所包括一个或者多个程序被所述一个或者多个控制器510执行时，实现如下操作：接收网络设备的上线认证请求并对所述网络设备进行认证；在认证通过的情况下，根据预配置信息创建所述网络设备的环回接口并分配环回接口地址，所述预配置信息包括环回接口地址池以及第一地址分配规则；通过所述环回接口地址管理所述网络设备。
本实施例提出的网络管理设备与上述实施例提出的网络设备管理方法属于同一发明构思，未在本实施例中详尽描述的技术细节可参见上述任意实施例，并且本实施例具备与执行网络设备管理方法相同的有益效果。
本公开实施例还提供一种包含计算机可执行指令的存储介质，计算机可执行指令在由计算机控制器执行时用于执行一种网络设备管理方法。
通过以上关于实施方式的描述，所属领域的技术人员可以了解到，本公开可借助软件及通用硬件来实现，也可以通过硬件实现。基于这样的理解，本公开的技术方案可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如计算机的软盘、只读存储器(Read-Only Memory,ROM)、随机存取存储器(Random Access Memory,RAM)、闪存(FLASH)、硬盘或光盘等，包括多个指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本公开任意实施例所述的方法。
以上所述，仅为本公开的示例性实施例而已，并非用于限定本公开的保护范围。
本公开附图中的任何逻辑流程的框图可以表示程序步骤，或者可以表示相互连接的逻 辑电路、模块和功能，或者可以表示程序步骤与逻辑电路、模块和功能的组合。计算机程序可以存储在存储器上。存储器可以具有任何适合于本地技术环境的类型并且可以使用任何适合的数据存储技术实现，例如但不限于只读存储器(ROM)、随机访问存储器(RAM)、光存储器装置和系统(数码多功能光碟DVD或CD光盘)等。计算机可读介质可以包括非瞬时性存储介质。数据控制器可以是任何适合于本地技术环境的类型，例如但不限于通用计算机、专用计算机、微控制器、数字信号控制器(DSP)、专用集成电路(ASIC)、可编程逻辑器件(FGPA)以及基于多核控制器架构的控制器。
通过示范性和非限制性的示例，上文已提供了对本公开的示范实施例的详细描述。但结合附图和权利要求来考虑，对以上实施例的多种修改和调整对本领域技术人员来说是显而易见的，但不偏离本发明的范围。因此，本发明的恰当范围将根据权利要求确定。

Claims (10)

  1. 一种网络设备管理方法，包括：
    接收网络设备的上线认证请求并对所述网络设备进行认证；
    在认证通过的情况下，根据预配置信息创建所述网络设备的环回接口并分配环回接口地址，所述预配置信息包括环回接口地址池以及第一地址分配规则；以及
    通过所述环回接口地址管理所述网络设备。
  2. 根据权利要求1所述的方法，其中，所述预配置信息还包括安全管理通道接口地址池以及第二地址分配规则；
    在分配环回接口地址之后，还包括：
    根据所述预配置信息分别创建所述网络设备和对应的网关网元的安全管理通道并分配安全管理通道接口地址；
    所述通过所述环回接口地址管理所述网络设备，包括：
    通过所述安全管理通道和所述环回接口地址管理所述网络设备。
  3. 根据权利要求2所述的方法，还包括：
    向所述网络设备下发第一静态路由，所述第一静态路由的目的地址为广域网WAN端口地址，下一跳为所述网关网元的安全管理通道接口地址；
    向所述网关网元下发第二静态路由，所述第二静态路由的目的地址为所述网络设备的环回接口地址，下一跳为所述网络设备的安全管理通道接口地址。
  4. 根据权利要求1所述的方法，其中，所述预配置信息还包括：WAN端口地址信息、网络设备标识信息表和网络设备业务配置信息表；其中，
    所述WAN端口地址信息包括：WAN端口地址池以及第三地址分配规则；
    所述网络设备标识信息表包括：网络设备对应的设备序列号和设备类型；
    所述网络设备业务配置信息表包括：网络设备对应的设备序列号、WAN端口地址、通信方式、上线认证地址和端口、认证密钥、网络配置使能状态和安全管理通道使能状态。
  5. 根据权利要求4所述的方法，其中，在接收网络设备的上线认证请求之前，还包括：
    根据所述通信方式向所述网络设备下发统一资源定位符，所述统一资源定位符经过所述认证密钥加密；
    其中，所述统一资源定位符携带上线配置信息，所述上线配置信息包括WAN端口地址、上线认证地址和端口、网络配置使能状态；
    在所述安全管理通道使能状态为开启的情况下，所述上线配置信息还包括对应的网关网元的安全管理通道接口地址。
  6. 根据权利要求5所述的方法，其中，所述上线认证请求由所述网络设备以传输控制协议TCP会话的形式通过上线认证端口发送至所述上线认证地址；
    所述上线认证请求中携带所述网络设备的设备序列号和传输层安全协议TLS证书。
  7. 根据权利要求6所述的方法，其中，对所述网络设备进行认证，包括：
    若所述网络设备的设备序列号属于所述预配置信息中的设备序列号，则验证所述网络设备的TLS证书，并在TLS证书验证通过的情况下启动网络配置协议，认证通过；
    若所述网络设备的设备序列号不属于所述预配置信息中的设备序列号，则终止TCP会话，认证失败。
  8. 一种网络设备管理装置，包括：
    认证模块，设置为接收网络设备的上线认证请求并对所述网络设备进行认证；
    接口创建模块，设置为在认证通过的情况下，根据预配置信息创建所述网络设备的环回接口并分配环回接口地址，所述预配置信息包括环回接口地址池以及第一地址分配规则；
    管理模块，设置为通过所述环回接口地址管理所述网络设备。
  9. 一种网络管理设备，包括：
    一个或多个控制器；
    存储装置，设置为存储一个或多个程序；
    当所述一个或多个程序被所述一个或多个控制器执行，使得所述一个或多个控制器实现如权利要求1-7中任一所述的网络设备管理方法。
  10. 一种计算机可读存储介质，其上存储有计算机程序，其中于，该程序被控制器执行时实现如权利要求1-7中任一所述的网络设备管理方法。
PCT/CN2020/127222 2019-11-29 2020-11-06 一种网络设备管理方法、装置、网络管理设备及介质 WO2021103986A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP20891617.1A EP4064745A4 (en) 2019-11-29 2020-11-06 NETWORK DEVICE MANAGEMENT METHOD AND APPARATUS, NETWORK MANAGEMENT DEVICE AND MEDIA THEREOF

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911198866.7 2019-11-29
CN201911198866.7A CN112887968B (zh) 2019-11-29 2019-11-29 一种网络设备管理方法、装置、网络管理设备及介质

Publications (1)

Publication Number Publication Date
WO2021103986A1 true WO2021103986A1 (zh) 2021-06-03

Family

ID=76038403

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/127222 WO2021103986A1 (zh) 2019-11-29 2020-11-06 一种网络设备管理方法、装置、网络管理设备及介质

Country Status (3)

Country Link
EP (1) EP4064745A4 (zh)
CN (1) CN112887968B (zh)
WO (1) WO2021103986A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008092351A1 (fr) * 2007-01-26 2008-08-07 Maipu Communication Technology Co., Ltd. Procédé de liaison dynamique de réseau privé virtuel
CN101494669A (zh) * 2009-03-10 2009-07-29 华为技术有限公司 给用户终端分配ip地址的方法和装置
US20100146086A1 (en) * 2008-12-09 2010-06-10 The Go Daddy Group, Inc. Using routing protocols to migrate a hosted account
CN106162549A (zh) * 2015-05-19 2016-11-23 中兴通讯股份有限公司 接入网络的处理方法及装置
CN108429824A (zh) * 2018-05-31 2018-08-21 新华三技术有限公司 一种地址分配方法及装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9560018B2 (en) * 2014-12-08 2017-01-31 Cisco Technology, Inc. Autonomic locator/identifier separation protocol for secure hybrid cloud extension

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008092351A1 (fr) * 2007-01-26 2008-08-07 Maipu Communication Technology Co., Ltd. Procédé de liaison dynamique de réseau privé virtuel
US20100146086A1 (en) * 2008-12-09 2010-06-10 The Go Daddy Group, Inc. Using routing protocols to migrate a hosted account
CN101494669A (zh) * 2009-03-10 2009-07-29 华为技术有限公司 给用户终端分配ip地址的方法和装置
CN106162549A (zh) * 2015-05-19 2016-11-23 中兴通讯股份有限公司 接入网络的处理方法及装置
CN108429824A (zh) * 2018-05-31 2018-08-21 新华三技术有限公司 一种地址分配方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4064745A4 *

Also Published As

Publication number Publication date
EP4064745A1 (en) 2022-09-28
EP4064745A4 (en) 2023-01-18
CN112887968B (zh) 2023-11-17
CN112887968A (zh) 2021-06-01

Similar Documents

Publication Publication Date Title
US11038682B2 (en) Communication method, apparatus and system, electronic device, and computer readable storage medium
US8577044B2 (en) Method and apparatus for automatic and secure distribution of an asymmetric key security credential in a utility computing environment
CN110191031B (zh) 网络资源访问方法、装置、电子设备
US9485147B2 (en) Method and device thereof for automatically finding and configuring virtual network
CN110417929B (zh) 通过在区块链网络上运行dhcp服务器提供的高可用性dhcp服务
WO2016106560A1 (zh) 一种实现远程接入的方法、装置及系统
WO2018019299A1 (zh) 一种虚拟宽带接入方法、控制器和系统
WO2010068698A2 (en) System and method for providing virtual private networks
US20170126623A1 (en) Protected Subnet Interconnect
WO2011140919A1 (zh) 接入业务批发网络的方法、设备、服务器和系统
CN108462752B (zh) 一种访问共享网络的方法、系统及vpc管理设备以及可读存储介质
JP2016531464A (ja) 通信ネットワークにおけるセキュアサービス管理
US20220232000A1 (en) Secure communication system
CN102571811A (zh) 用户接入权限控制系统和方法
CN110830351A (zh) 基于SaaS服务模式的租户管理及服务提供方法、装置
US20230179582A1 (en) Centralized management of private networks
WO2023134557A1 (zh) 一种基于工业互联网标识的处理方法及装置
JP2012044601A (ja) 設定システム、設定方法、及び設定プログラム
WO2021103986A1 (zh) 一种网络设备管理方法、装置、网络管理设备及介质
CN114884771B (zh) 基于零信任理念的身份化网络构建方法、装置和系统
US20220368688A1 (en) Secure communication system
WO2022016435A1 (zh) 接入认证方法、装置、设备及存储介质
TW201517654A (zh) 傳輸路徑控制系統
WO2016082363A1 (zh) 用户数据管理方法及装置
JP2005012485A (ja) インタネットｖｐｎ構築システム、制御サーバ及びそれらに用いるｖｐｎ構築方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20891617

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020891617

Country of ref document: EP

Effective date: 20220620

NENP Non-entry into the national phase

Ref country code: DE