IBM® is a registered trademark of International Business Machines Corporation, Armonk, N.Y., U.S.A. Other names used herein may be registered trademarks, trademarks or product names of International Business Machines Corporation or other companies.
The present disclosure relates generally to implementation of computer network resources and, in particular, to implementation of firewall solutions.
As the number of managed resources in a company increases, it becomes more difficult for a system administrator to configure firewalls. Some of the challenging aspects of the configuration process include the heterogeneous nature of resources and the visualization of the relationships between resources in a network. Managing firewalls becomes confusing, tedious and requires expert oversight.
Many firewall configuration tools are available today. Examples range from software included on routers, to enterprise network management software, one example of the former being the D-Link DI-604 router, which contains basic firewall capabilities, one example of the latter being the Cisco Secure Policy Manager, which provides topology-aware firewall management. However, these existing products only provide the ability to configure firewalls on specific routers. They do not provide for detection of relationships with other resources within the network, and therefore do not provide a desired level of protection.
What network administrators need is a tool that enables them to implement complex firewall solutions by choosing virtual resources, regardless of platform for protection.
Disclosed herein is an apparatus for configuring at least one port in a topology, the apparatus including means for selecting from within a graphic depiction of the topology at least one resource comprising at least one port; means for selecting the at least one port; means for selecting a configuration for the at least one port; and means for applying the at least one configuration to the at least one port.
Also disclosed is a computer program product stored on machine readable media and for configuring at least one port in a topology, the computer program product including instructions for selecting from within a graphic depiction of the topology, at least one resource having at least one port; selecting at least one port of the at least one resource; configuring at least one port setting for the at least one port; and, applying the at least one port setting to the at least one port.
Further disclosed is a port configuration utility for configuring at least one port in a network of resources, the port configuration utility that includes a graphic depiction of the network, the utility having tools for selecting from the depiction at least one resource having at least one port; the utility further including a control panel for at least one of configuring the at least one port and obtaining a status of the at least one port. Other systems, methods, and/or computer program products according to embodiments will be or become apparent to one with skill in the art upon review of the following drawings and detailed description. It is intended that all such additional systems, methods, and/or computer program products be included within this description, be within the scope of the present invention, and be protected by the accompanying claims.
Additional features and advantages are realized through the techniques of the present invention. Other embodiments and aspects of the invention are described in detail herein and are considered a part of the claimed invention. For a better understanding of the invention with advantages and features, refer to the description and to the drawings.
As a result of the summarized invention, technically we have achieved a solution that includes a port configuration utility having a graphic depiction of resources within a topology, and provides a user with at least a control panel for selecting ports of resources within the topology, configuring the ports and monitoring the status of the ports. The port configuration utility may include additional features for scheduling operations as well as accessing and managing port related information. The port configuration utility provides for higher speed of completion for some administrative tasks, as well as increased security of resources, through a simple user interface that provides direct control over port settings.
The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the invention are apparent from the following detailed description taken in conjunction with the accompanying drawings in which:
The detailed description explains the preferred embodiments of the invention, together with advantages and features, by way of example with reference to the drawings.
The capabilities of the present invention can be implemented in software, firmware, hardware or some combination thereof. As one example, one or more aspects of the present invention can be included in an article of manufacture (e.g., one or more computer program products) having, for instance, computer usable media. The media has embodied therein, for instance, computer readable program code means for providing and facilitating the capabilities of the present invention. The article of manufacture can be included as a part of a computer system or sold separately. Additionally, at least one program storage device readable by a machine, tangibly embodying at least one program of instructions executable by the machine to perform the capabilities of the present invention can be provided.
The user-interface 11 typically includes other facilities, such as at least one dynamic tool bar 8. The tool bar 8 typically provides users with quick access to tools such as context sensitive or frequently used commands or information. As such toolbars are generally known in the art, these are not discussed further herein.
In the typical embodiment, the user makes use of the graphic depiction 14 to select resources 13 within the topology 12. Once the selected resource 13 has been recognized by the port configuration utility 10, a control panel 15 may be used to configure aspects of the resource 13. As depicted in
Note that as used herein, the term “topology” makes reference to aspects of the design and virtual depiction of the actual network 16. Accordingly, the topology 12 and the network 16 are closely related, and in some instances, the terms are synonymous.
In the typical embodiment, and as disclosed herein, the port configuration utility 10 is native to one environment, such as for personal computers (one example being WINDOWS by MICROSOFT Corporation). However, the port configuration utility 10 is typically operable across a variety of platforms and operating systems. Typically, the port configuration utility 10 is implemented as a computer code which uses one of the resources 13 in the network 16, such as a terminal dedicated for use by a network administrator. Preferably, the port configuration utility 10 is programmed using known software development tools. In some embodiments, the port configuration utility 10 is implemented through a browser interface.
The port configuration utility 10 makes use of known techniques and environment features for to ascertain required information. For example, in one embodiment, the port configuration utility 10 interrogates resources 13 to obtain status of selected ports. In other embodiments, the port configuration utility 10 includes various components resident in each of the resources 13, wherein the components communicate with the port configuration utility 10 to provide information and control over aspects of the respective resource 13.
Accordingly, it should be understood that the resources 13 depicted may be unique to each other in a variety of ways. Accordingly, it should be understood that the port configuration utility 10 is disclosed herein in terms of the WINDOWS environment. For example, the terms “port” and “ports” are generally defined by aspects thereof known to those skilled in the art. However, it must be recognized that aspects of these teachings are applicable to other platforms and environments. Therefore, the teachings herein are merely illustrative and not limiting of the invention.
In typical embodiments, the user can check for a status of any one up to all of the ports on any one up to all of the selected resources 13. In doing so, the port configuration utility 10 queries the selected resources 13 for the status of each of the selected ports and displays the result.
An exemplary use of the port configuration utility 10 involves managing aspects of firewalls within the topology 12. Although discussed herein as a technique for configuring firewall settings, it is recognized that the port configuration utility 10 may be used to govern many other aspects of ports and uses thereof.
When managing firewall configurations, typically, the user (i.e., the network administrator) will use the port configuration utility 10 to block or unblock any number of ports across the selected resources 13. The user is able to specify an identity (such as a URL) of a firewall to be configured. Following identification, the port configuration utility 10 is used to create or modify at least one filter, such as an IP filter, for the firewall. Typically, the firewall resides on a gateway to the resources 13 in order to provide for maximum security. In order to create or modify filters, a common framework for router configuration is typically implemented. The common framework is preferably a part of the management software and effectively virtualizes all routers on the network 16. Since most routers include a web interface, implementing the common framework for managing configurations of resources 13 is straightforward. In some embodiments, the common framework takes advantage of the web interface, and other aspects of the resources 13. For example, the common framework in some embodiments is designed to prompt the user for credentials in order to authenticate proper authority to manage configurations within the network 16.
In some embodiments, additional features such as monitoring and scheduling of configurations are included. Non-limiting and additional examples of features of the port configuration utility 10 include: a capability to create and apply port configuration profiles; a capability to filter graphical display of resources based on port status; a capability to view the status of the selected port by specifying a port number or an application associated with the port; and a capability to provide a graphical annotation of port status. Each of these exemplary and non-limiting capabilities is now discussed in more detail.
With regard to creating and applying port configuration profiles, it is recognized that some resources 13 in the typical network 16 perform unique functions. For example, a mail server handles all the incoming and outgoing mail. For this type of resource 13, a network administrator can use the port configuration utility 10 to create a port configuration profile that specifies which ports should be blocked and which ports should not be blocked. The port configuration profile can be saved and applied to other resources 13 in the network 16 as deemed appropriate. For example, the port configuration profile may be applied to a secondary mail server. In other words, port configuration profiles can be applied by the user to set configurations quickly and easily. Reference may be had to
Referring also to
Further, as depicted in
Accordingly, and as depicted in
After performing this latter filter, the administrator could proceed to block the peer-to-peer file sharing application on the remaining systems. These techniques are more apparent with reference to
Referring now to
A further and exemplary feature of the port configuration utility 10 includes the capability to view (i.e., return) the status of a port by specifying a port number or an application associated with the use of the port. For example, an application as defined by the Internet Assigned Numbers Authority. More specifically, many of the resources 13 may include a large number (e.g., thousands) of ports. A user can not practically memorize the port number that a specific application uses. Accordingly, this feature enables the user to specify an application name and search for the associated port to view the status of the port. Advanced users can specify a port number rather than search by application.
As a further exemplary feature of the port configuration utility 10, a user can drill down into a resource and view a graphical annotation of the port statuses to help identify which ports have been configured. Reference may be had to
In
An exemplary method for using the port configuration utility 10 is depicted in
Another exemplary technique for using the port configuration utility 10 is depicted in
The flow (and other) diagrams depicted herein are just examples. There may be many variations to these diagrams or the steps (or operations) described therein without departing from the spirit of the invention. For instance, the steps may be performed in a differing order, or steps may be added, deleted or modified. All of these variations are considered a part of the claimed invention.
While the preferred embodiment to the invention has been described, it will be understood that those skilled in the art, both now and in the future, may make various improvements and enhancements which fall within the scope of the claims which follow. These claims should be construed to maintain the proper protection for the invention first described.