[go: up one dir, main page]

WO2019037775A1 - 下发业务配置文件 - Google Patents

下发业务配置文件 Download PDF

Info

Publication number
WO2019037775A1
WO2019037775A1 PCT/CN2018/102196 CN2018102196W WO2019037775A1 WO 2019037775 A1 WO2019037775 A1 WO 2019037775A1 CN 2018102196 W CN2018102196 W CN 2018102196W WO 2019037775 A1 WO2019037775 A1 WO 2019037775A1
Authority
WO
WIPO (PCT)
Prior art keywords
configuration file
logical device
service
server
address
Prior art date
Application number
PCT/CN2018/102196
Other languages
English (en)
French (fr)
Inventor
夏添
Original Assignee
新华三信息安全技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 新华三信息安全技术有限公司 filed Critical 新华三信息安全技术有限公司
Priority to EP18848673.2A priority Critical patent/EP3675418B1/en
Publication of WO2019037775A1 publication Critical patent/WO2019037775A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0876—Aspects of the degree of configuration automation
    • H04L41/0886—Fully automatic configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/084—Configuration by using pre-existing information, e.g. using templates or copying from other elements
    • H04L41/0843—Configuration by using pre-existing information, e.g. using templates or copying from other elements based on generic templates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/2866—Architectures; Arrangements
    • H04L67/30—Profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0876—Aspects of the degree of configuration automation
    • H04L41/0883—Semiautomatic configuration, e.g. proposals from system

Definitions

  • a physical device such as a physical firewall
  • logical devices such as logical firewalls
  • virtualization technology Each logical firewall runs independently.
  • the firewall has its own dedicated hardware and software resources. When a logical firewall is created, started, restarted, or deleted, it does not affect the operation of other logical firewalls. Because a physical firewall can be divided into multiple logical firewalls, it can effectively save deployment costs, improve networking flexibility, facilitate management and maintenance, and effectively reduce management and maintenance costs.
  • 1A is a flowchart of a method for sending a service configuration file according to an embodiment of the present application
  • FIG. 1B is a flowchart of another method for delivering a service profile according to an embodiment of the present application
  • 1C is a flowchart of another method for delivering a service profile according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a page form provided by an embodiment of the present application.
  • 3A is a schematic diagram of an application scenario provided by an embodiment of the present application.
  • FIG. 3B is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 4 is a structural block diagram of an apparatus for delivering a service profile according to an embodiment of the present application.
  • FIG. 5 is a structural block diagram of an apparatus for sending a service configuration file according to an embodiment of the present disclosure
  • FIG. 6 is a structural block diagram of an apparatus for sending a service configuration file according to an embodiment of the present application
  • FIG. 7 is a block diagram showing the hardware structure of a server according to an embodiment of the present application.
  • a physical device such as a physical firewall
  • logical devices such as logical firewalls
  • virtualization technology Each logical firewall runs independently.
  • the firewall has its own dedicated hardware and software resources. Moreover, when creating, starting, restarting, and deleting a logical firewall, it will not affect the operation of other logical firewalls. Because a physical firewall can be divided into multiple logical firewalls, it can effectively save deployment costs, improve networking flexibility, facilitate management and maintenance, and effectively reduce management and maintenance costs.
  • the embodiment of the present application provides a method for sending a service configuration file, where the method can be applied to an MDC system.
  • the MDC system can include a physical device and a first server.
  • the virtualization device can virtualize the physical device to at least one logical device.
  • a physical device is a physical firewall
  • a logical device is a logical firewall.
  • Each logical firewall is a firewall that runs independently and has its own dedicated hardware and software resources. When a logical firewall is created, started, restarted, or deleted, it does not affect. The operation of other logical firewalls.
  • the method for sending a service configuration file after receiving the DHCP request message sent by the logical device, the first server may determine address information corresponding to the service configuration file of the logical device, and then send the address information to the logical device.
  • Sending a DHCP response message carrying the address information so that the logical device acquires the service configuration file of the logical device according to the address information in the DHCP response message, thereby implementing the automatic delivery configuration file, without the administrator manually manually under each logical firewall.
  • Sending a business profile can reduce the workload of the administrator and avoid configuration file errors.
  • a flowchart of a method for sending a service profile may be applied to a first server, where the first server may be a DHCP (Dynamic Host Configuration Protocol) server.
  • the method can include the following steps.
  • Step 101 Receive a DHCP request message sent by a logical device, where the logical device is created on a physical device.
  • Step 102 Determine address information corresponding to a service profile of the logical device.
  • Step 103 Send a DHCP response message carrying the address information to the logical device, so that the logical device acquires a service configuration file of the logical device according to the address information in the DHCP response message.
  • the first process is to generate a service configuration file for the logical device and send the service configuration file to the logical device.
  • the second process is to configure the service configuration file.
  • the corresponding address information is sent to the logical device, so that the logical device obtains the service configuration file by using the address information.
  • Both of the above processes can be performed by the first server.
  • the above two processes can also be performed by different servers, the first process being performed by the second server and the second process being performed by the first server.
  • the second server may be any server that does not have a DHCP function in the MDC network. At the same time, the second server may have a function of generating a service profile for the logical device and identity authentication.
  • the IP address of the second server may be pre-recorded on the first server, the second server provides a service configuration file for the logical device, and the first server may configure the second server.
  • the second server may generate a service configuration file for the logical device, and the specific processing procedure will be described in detail later.
  • the service configuration file cannot be obtained directly from the second server.
  • the logical device can send a DHCP request message in a broadcast manner.
  • the second server discards the DHCP request message because the second server does not have the DHCP function.
  • the first server can process the DHCP request message because the first server has a DHCP function.
  • the first server may allocate an IP address to the logical device.
  • the first server can obtain the IP address of the second server and determine the IP address of the second server. Address information corresponding to the service profile of the logical device. Then, the first server sends a DHCP response message carrying the address information to the logical device, and the DHCP response message may carry the IP address allocated for the logical device, in addition to carrying the IP address of the second server.
  • the logical device may parse the address information from the DHCP response message, and obtain a service configuration file from the second server corresponding to the address information.
  • the first server may generate a service configuration file for the logical device, and record a URL (Uniform Resource Locator) address corresponding to the storage location of the service configuration file.
  • a server can assign an IP address to the logical device.
  • the first server may also query the URL address corresponding to the storage location of the service profile from the local location, and determine the URL address as the address information corresponding to the service profile. Then, the first server sends a DHCP response message carrying the address information to the logical device, and the DHCP response message may carry the IP address assigned to the logical device in addition to the URL address.
  • the logical device may parse the address information (ie, the URL address corresponding to the storage location of the service configuration file) from the DHCP response message, and obtain the service configuration from the storage location corresponding to the URL address. file.
  • the address information ie, the URL address corresponding to the storage location of the service configuration file
  • the processing of the step 101 to the step 103 is described in detail by taking the two processes of the first server as an example.
  • Step 111 The first server receives an authentication request message sent by the host.
  • the authentication request message may carry user identity information of the user, and the user identity information of the user may include a username and a password.
  • step 112 is performed; if it is determined that the authentication is not passed based on the user identity information, the authentication failure message is returned to the host, and the authentication is taken as an example for description.
  • the user in the local area network can register the username and password in the first server, for example, the registered user name "AA" and the password "123456".
  • the first server can also configure a user authorization level.
  • the user authorization level is related to the user's purchase service, and there is no restriction on the user authorization level allocation mode.
  • the first server can maintain the association table.
  • the association table can be used to record information such as a user name, a password, and a user authorization level.
  • the device identifier, the service configuration file, and the address information corresponding to the service configuration file can also be recorded. In the initial state, the association table can be as shown in Table 1.
  • the user can send an authentication request message to the first server by using the host, and the authentication request message carries the user identity information.
  • the first server may perform identity authentication based on the user identity information. If it is determined that the user identity information passes the authentication, step 112 is performed. If the user identity information is determined not to pass the authentication, the first server returns the authentication. Failure message.
  • the certification is taken as an example for explanation.
  • the user identity information of the user 1 exists in the association table shown in Table 1, the user identity information is authenticated; if the user identity information of the user 1 does not exist in the association table shown in Table 1, the user identity information If the authentication is not passed, an authentication failure message is returned to the host 111.
  • the user may also select a service type of the logical device, and the service type may include, but is not limited to, an IPS (Intrusion Prevention System) type, an AV (anti-virus wall) type, and the like.
  • the host receives the selection instruction input by the user, and the selection instruction carries the service type, and the host can add the service type to the authentication request message, that is, the authentication request message can also carry the service type of the logical device. For example, the host can add the identity of the service type to the authentication request message.
  • Step 112 The first server allocates a device identifier to the logical device to be created, and obtains a user authorization level corresponding to the user identity information, and determines physical resource information corresponding to the user authorization level; and physical device corresponding to the user identity information. And sending a creation message, where the creation message carries the device identifier and the physical resource information, so that the physical device creates the logical device by using the device identifier and the physical resource information.
  • the physical resource information is information about the necessary resources when the logical device is started.
  • the physical resource information may include, but is not limited to, one or any combination of the following: hardware resources (such as disks), CPU, memory, maximum throughput, The number of sessions, etc.
  • the first server may allocate the device identifier to the logical device to be created.
  • the first server may further query the user authorization level corresponding to the user identity information in the association table according to the user identity information, and further, according to the preset user authorization level. Corresponding relationship with the physical resource information, and determining physical resource information corresponding to the user authorization level. The correspondence between the user authorization level and the physical resource information may be configured by a technician.
  • the first server may also maintain a correspondence between the user authorization level and the physical resource information, such as the correspondence between the user authorization level 1 and the physical resource information 1, the correspondence between the user authorization level 2 and the physical resource information 2, and so on.
  • the first server may maintain a correspondence between the user identity information and the physical device in the association table, and the correspondence relationship is not shown in Table 1.
  • the first server may determine a physical device corresponding to the user identity information, where the user identity information is user identity information carried in the authentication request message.
  • the first server can then send a create message to the physical device.
  • the creation message carries device identifier and physical resource information.
  • the physical device After receiving the creation message, the physical device can parse the device identifier and the physical resource information from the creation message, and then the physical device uses the device identifier and the physical resource information to create a logical device.
  • Step 113 The first server generates a service configuration file for the logical device, and determines a URL address corresponding to the storage location of the service configuration file, and records the device identifier of the logical device and the service configuration file of the logical device in the association table. The correspondence between URL addresses.
  • the service profile may include, but is not limited to, a basic profile and/or a custom profile.
  • the basic configuration file is related to the service type.
  • the logical devices of the same service type can use the same basic configuration file.
  • Different logical types of service types can use different basic configuration files.
  • the first server can store the basic configuration file of each service type, such as the basic configuration file A corresponding to the service type A and the basic configuration file B corresponding to the service type B. The manner of generating each basic configuration file will be described below, and details are not described herein again.
  • the customized configuration file can include the personality configuration of the logical device, such as ACL, speed limit threshold, etc.
  • the customized configuration file is related to the user's needs, that is, the customized configuration file can be generated according to the user's needs.
  • the first server may generate a service configuration file for the logical device, and then store the service configuration file, and record a URL address corresponding to a storage location of the service configuration file.
  • the first server may record the correspondence between the device identifier of the logical device and the URL address in the association table, where the URL address is the URL address of the service configuration file of the logical device.
  • the process for generating the service configuration file for the logical device may include, but is not limited to, the first server parsing the service type from the authentication request message, and generating the The basic configuration file corresponding to the business type.
  • the process for generating the service configuration file for the logical device may include, but is not limited to, the following:
  • the first server parses the service type from the authentication request message, and generates a basic configuration file corresponding to the service type; parses the user configuration information from the page response message, and generates a customized configuration file according to the user configuration information. .
  • the specific process is: the first server parses the service type from the authentication request message, and generates a basic configuration file corresponding to the service type for the logical device. Sending a page message carrying configuration parameters to the host, so that the host obtains user configuration information corresponding to the configuration parameter; and then receiving a page response message sent by the host, where the page response message carries the user configuration information, and according to the User configuration information generates a custom configuration file for the logical device.
  • the authentication request message may further carry the service type of the logical device to be created.
  • the first server may parse the service type from the authentication request message, and then generate a basic configuration file corresponding to the service type according to the correspondence between the preset service type and the basic configuration file.
  • the first server may further send a page message carrying the configuration parameter to the host, where the page message may include a page form, where the page form includes a device identifier of the logical device, a configuration parameter used to generate the customized configuration file, such as an interface name, an IP address, Interface VLAN, Network Address Translation (NAT) parameters, VPN (Virtual Private Network) parameters, etc.
  • a configuration parameter used to generate the customized configuration file such as an interface name, an IP address, Interface VLAN, Network Address Translation (NAT) parameters, VPN (Virtual Private Network) parameters, etc.
  • NAT Network Address Translation
  • VPN Virtual Private Network
  • the host can display the page form to the user. Based on the device identifier displayed on the page form, the user can know which logical device is to be input with user configuration information, and input user configuration information corresponding to the configuration parameter in the page form.
  • the interface name is interface A
  • the interface IP address is 200.0.0.9
  • the interface VLAN is VLAN 101
  • the NAT parameter is to convert IP address A to IP address B
  • the VPN parameter is to listen to IP network segment R and listening port X.
  • the user configuration information input by the user in the page form may further include the following: a URL that is prohibited from accessing (for example, www.aaa.com), a bandwidth limitation for performing speed limit processing, an IP address for which access is prohibited, and the like.
  • a URL that is prohibited from accessing
  • a bandwidth limitation for performing speed limit processing for example, www.aaa.com
  • the host obtains the device configuration information and the device identifier included in the page form, and sends a page response message to the first server, where the page response message carries the user configuration information and the device identifier.
  • the first server parses the user configuration information and the device identifier from the page response message.
  • the first server may generate a customized configuration file for the logical device according to the user configuration information.
  • the customized configuration file A may include a deny ACL (Access Control List), such as deny 220.0. 0.5 (ie the IP address corresponding to www.aaa.com).
  • the configuration file A can include a rate limit command line, such as a CAR (Committed Access Rate) 5000 kbps.
  • the customized configuration file A may include an ACL for prohibiting the IP address from accessing the network.
  • the above process is only an example of generating a custom configuration file A, and there is no limitation thereto.
  • the first server may obtain a service type and a user configuration information by sending a page message, thereby generating a basic configuration file and a customized configuration file.
  • the specific process is: sending a page message carrying the configuration parameter to the host, so that the host obtains the service type and the user configuration information corresponding to the configuration parameter; and then, the receiving host sends a page response message, where the page response message carries the service type.
  • the user configuration information generating a basic configuration file corresponding to the service type for the logical device, and generating a customized configuration file for the logical device according to the user configuration information.
  • the first server may send a page message to the host, where the page message carries the configuration parameter.
  • the host can display the page form to the user. Based on the device identifier displayed on the page form, the user can know which logical device needs to input user configuration information, and input user configuration information corresponding to the configuration parameter and the service type of the logical device in the page form.
  • the interface name is interface A
  • the interface IP address is 200.0.0.9
  • the interface VLAN is VLAN 101
  • the NAT parameter is to convert IP address A to IP address B
  • the VPN parameter is to listen to IP network segment R and listening port X, etc.
  • IPS type For IPS type.
  • the user configuration information input by the user in the page form may further include the following: a URL that is prohibited from accessing (for example, www.aaa.com), a bandwidth limitation for performing speed limit processing, an IP address for which access is prohibited, and the like.
  • a URL that is prohibited from accessing for example, www.aaa.com
  • a bandwidth limitation for performing speed limit processing for example, an IP address for which access is prohibited, and the like.
  • IP address for which access is prohibited
  • the host obtains the device configuration information, the service type, and the device identifier included in the page form, and sends a page response message to the first server, where the page response message carries the user configuration information, the service type, and the device identifier.
  • the first server parses the user configuration information, the service type, and the device identifier from the page response message. Then, the first server generates a basic configuration file corresponding to the service type for the logical device according to the service type, and generates a customized configuration file for the logical device according to the user configuration information.
  • the first server may record the URL address of the basic configuration file and the URL address of the customized configuration file in the entry corresponding to the user identity information in the association table.
  • the name of the basic configuration file and the name of the customized configuration file may be recorded in the entry corresponding to the user identity information in the association table.
  • steps 112 and 113 have no sequential relationship, and the order is not limited.
  • Step 114 The first server receives a DHCP request message sent by the logical device.
  • the logical device after the physical device creates the logical device by using the device identifier and the physical resource information, the logical device does not have any configuration information, and does not have the address information of the first server, and cannot directly obtain the service configuration file from the first server. Based on this, the logical device may send a DHCP request message in a broadcast manner, where the DHCP request message carries the device identifier of the logical device, for example, the first option field (such as the Option 82 field) of the DHCP request message may carry the device of the logical device.
  • the logical device may send a DHCP request message in a broadcast manner, where the DHCP request message carries the device identifier of the logical device, for example, the first option field (such as the Option 82 field) of the DHCP request message may carry the device of the logical device.
  • the first option field such as the Option 82 field
  • Step 115 The first server determines address information corresponding to the service configuration file of the logical device.
  • the first server after receiving the DHCP request message, the first server may have a DHCP function, so the DHCP request message may be processed, that is, the logical device is assigned an IP address.
  • the first server may also parse the device identifier of the logical device from the DHCP request message, and query the association table through the device identifier to obtain the URL address of the service configuration file corresponding to the device identifier, and the URL is obtained.
  • the address is determined to be address information corresponding to the service profile of the logical device.
  • Step 116 The first server sends a DHCP response message carrying the address information to the logical device.
  • the address information is a URL address of the service configuration file.
  • the address information can be carried through a second option field (such as the Option 100 field) of the DHCP response message.
  • the DHCP response message may carry the IP address assigned by the first server to the logical device in addition to the address information.
  • the logical device After receiving the DHCP response message, the logical device parses the address information corresponding to the service configuration file from the DHCP response message, and obtains the service configuration file according to the address information.
  • the process of the logical device acquiring the service configuration file according to the address information may be: the logical device may send a download request message to the first server, where the download request message carries the address information.
  • the first server parses the address information, that is, the URL address of the service configuration file, from the download request message, and obtains the service configuration corresponding to the logical device from the storage location corresponding to the URL address.
  • the file then sends a download response message to the logical device, the download response message carrying the service profile.
  • the logical device can obtain the service profile from the download response message and then load the service profile to complete its configuration. In this way, the logical device can automatically load the service configuration file and complete its configuration without manual configuration by the administrator, which can reduce the workload of the administrator and improve the efficiency of configuring the logical device.
  • the download service function provided by the first server to the logical device may be a download service function using a file transfer protocol (FTP).
  • FTP file transfer protocol
  • other types of download service functions may be used.
  • each user can register at the second server, and the second server can maintain the association table shown in Table 1.
  • Step 111'-step 113' the process flow refers to step 111-step 113 in the process flow shown in FIG. 1B, and the difference is that in FIG. 1B, the related process of step 111-step 113 is performed by the first server. In FIG. 1C, the related processing of step 111'-step 113' is performed by the second server, and details are not described herein again.
  • Step 114' the first server and the second server both receive a DHCP request message.
  • the second server Since the second server does not have a DHCP function, the second server discards the DHCP request message. After receiving the DHCP request message, the first server may respond to the DHCP request message because the first server has a DHCP function.
  • Step 115' the first server determines address information corresponding to the service profile of the logical device.
  • the IP address of the second server may be pre-recorded on the first server, and the first server may configure the second server as a server for providing a service profile for the logical device.
  • the first server may allocate an IP address to the logical device.
  • the first server can also query the IP address of the second server from the local after receiving the DHCP request message, and the second The IP address of the server is determined as the address information corresponding to the service profile.
  • Step 116' the first server sends a DHCP response message carrying the address information to the logical device.
  • the address information is an IP address of the second server.
  • the address information can be carried through a second option field (such as the Option 100 field) of the DHCP response message.
  • the DHCP response message may carry the IP address assigned by the first server to the logical device in addition to the address information, for example, the IP address may be carried in the yiaddr (Chinese: Your IP address) field.
  • the logical device After receiving the DHCP response message, the logical device parses the address information corresponding to the service configuration file from the DHCP response message, and obtains the service configuration file according to the address information.
  • the process for the logical device to obtain the service configuration file according to the address information may be: the logical device sends a request message for requesting the URL address to the second server according to the IP address of the second server, the request message Carry the device identification.
  • the second server parses the request message to obtain the device identifier.
  • the second server queries the association table by using the device identifier, and obtains a URL address corresponding to the device identifier.
  • the second server sends a response message to the logical device, the response message carrying the URL address.
  • the logical device sends a download request message to the second server, the download request message carrying the URL address.
  • the second server After receiving the download request message, the second server parses the address information, that is, the URL address of the service configuration file, from the download request message, and acquires the service corresponding to the logical device from the storage location corresponding to the URL address.
  • the configuration file then sends a download response message to the logical device, the download response message carrying the service configuration file.
  • the logical device can obtain the service profile from the download response message and then load the service profile to complete its configuration. In this way, the logical device can automatically load the service configuration file and complete its configuration without manual configuration by the administrator, which can reduce the workload of the administrator and improve the efficiency of configuring the logical device.
  • the download service function provided by the second server to the logical device may be a download service function using a file transfer protocol (FTP). Of course, other types of download service functions may be used.
  • FTP file transfer protocol
  • the service configuration file may be automatically sent to the logical device (such as a logical firewall, etc.), instead of manually assigning a service configuration file to the logical device by the administrator, thereby reducing the workload of the administrator. And you can avoid business configuration file errors.
  • the logical device such as a logical firewall, etc.
  • the first server after receiving the DHCP request message, the first server does not directly send the service configuration file to the logical device, but sends the URL address of the service configuration file or the IP address of the second server to the logic.
  • the reason for the device may include: when the first server receives the DHCP request message, it cannot know whether the logical device can work normally. If the service configuration file is sent to the logical device at this time, it is assumed that the logical device is not working normally yet, Business profiles are not processed correctly, making it impossible to configure with business profiles. However, if the logical device can work normally, the download request message is sent, that is, the logical device can request to download the service configuration file through the download request message. If the service configuration file is sent to the logical device at this time, the logical device can correctly process the file. Business profile.
  • the application scenario is as shown in FIG. 3A , which is a networking diagram of an application scenario in the first embodiment of the present application.
  • the first server is configured to provide an authentication function, a DHCP function, and a download service function.
  • the download service function is described by taking the download service function of FTP (File Transfer Protocol) as an example. Of course, other types of download service functions may be used, and no limitation is imposed on this.
  • the authentication function can be a function of authenticating a user, such as an authentication function based on a username and a password. Based on the authentication function, the first server can authenticate the user. After the authentication is passed, the physical device is allowed to create a logical device and generate a service configuration file for the logical device.
  • the first server can send the service configuration file to the logical device.
  • the first server may send the address information corresponding to the service configuration file to the logical device, and the logical device uses the address information to obtain the service configuration file.
  • the local area network 1, the local area network 2, and the local area network 3 are connected to the external network through the physical device 12.
  • the physical device 12 includes three logical devices, which are a logical device 121, a logical device 122, and a logical device 123. In the initial state, the physical device 12 has no logical device. Applying the method provided in this embodiment of the present invention, a logical device can be created on the physical device 12, and the service configuration file is sent to the logical device.
  • the first server 131 can be registered, such as the registered user name "AA” and the password "123456", and the first server 131 can also pre-configure the user authorization level 1.
  • the first server 131 can register, such as the registered user name "BB” and the password "123123”, and the first server 131 can also pre-configure the user authorization level 2.
  • the first server 131 can be registered, such as the registered user name "CC” and the password "456456", and the first server 131 can also pre-configure the user authorization level 3.
  • the user authorization level is related to the user's purchase service, and there is no restriction on the user authorization level allocation mode.
  • the association table maintained by the first server 131 can be as shown in Table 1 above.
  • the user 1 in the local area network creates a logical device (ie, the logical device 121 in FIG. 3A) as an example for description.
  • the method for delivering a service profile in the embodiment of the present application may include the following steps.
  • step a1 the user 1 sends an authentication request message to the first server 131 through the host 111.
  • the authentication request message may carry the user identity information of the user 1.
  • the user identity information of the user 1 includes the user name “AA” and the password “123456”.
  • the user 1 may send an authentication request message to the physical device by using the host 111, the destination address of the authentication request message is an IP address of the first server 131, and the physical device according to the IP address of the first server 131, The authentication request message is forwarded to the first server 131.
  • the first server 131 After the first server 131 receives the authentication request message, if the user identity information of the user 1 exists in the table 1, the user identity information is authenticated, and step a3 is performed; if the user of the user 1 does not exist in the table 1 If the identity information is not authenticated, the authentication failure message is returned to the host 111. The process of authentication failure will not be described again, and the certification is taken as an example.
  • the first server 131 allocates a device identifier (such as abcd), and obtains the user authorization level 1 corresponding to the user identity information of the user 1 by querying the association table shown in the table 1, and determines that the user authorization level 1 corresponds to the user authorization level 1.
  • a device identifier such as abcd
  • the first server 131 can maintain the correspondence between the user authorization level and the physical resource information, such as the correspondence between the user authorization level 1 and the physical resource information 1, the correspondence between the user authorization level 2 and the physical resource information 2, and so on. Therefore, after obtaining the user authorization level 1, the first server 131 may determine that the physical resource information corresponding to the user authorization level 1 is the physical resource information 1.
  • the physical resource information is information about the necessary resources when the logical device is started.
  • the physical resource information may include, but is not limited to, one or any combination of the following: hardware resources (such as disks), CPU, memory, maximum throughput, The number of sessions, etc.
  • step a4 the first server 131 sends a creation message to the physical device 12 corresponding to the user identity information of the user 1, and the creation message carries the device identifier abcd and the physical resource information 1.
  • the first server 131 can maintain the correspondence between the user identity information and the physical device. For example, the correspondence between the user identity information and the physical device is maintained in the association table, and the correspondence relationship is not shown in Table 1. Based on this correspondence, the first server 131 can transmit a creation message to the physical device 12.
  • Step a5 After receiving the creation message, the physical device 12 creates a logical device (ie, the logical device 121 shown in FIG. 3A) by using the device identifier abcd and the physical resource information 1.
  • a logical device ie, the logical device 121 shown in FIG. 3A
  • Step a6 The first server 131 generates a service configuration file for the logical device 121, and records the correspondence between the device identifier abcd and the URL address of the service configuration file in Table 1.
  • step a6 There is no order relationship between step a6 and step a4 and step a5, and the order is not limited.
  • the service profile may include, but is not limited to, a basic profile and/or a custom profile.
  • the basic configuration file is related to the service type.
  • the logical devices of the same service type can use the same basic configuration file.
  • Different logical types of service types can use different basic configuration files.
  • the first server 131 can store the basic configuration file of each service type, such as the basic configuration file A corresponding to the service type A, and the basic configuration file B corresponding to the service type B, and the manner of generating the basic configuration files is not described herein.
  • the service type may include, but is not limited to, an IPS (Intrusion Prevention System) type, an AV (Anti-Virus) type, and the like.
  • the customized configuration file can include the personality configuration of the logical device, such as the ACL, the rate limit threshold, etc.
  • the customized configuration file is related to the user's needs, and the customized configuration file can be generated according to the user's needs.
  • the process of the “first server 131 generating a service profile for the logical device 121” may include the following two situations:
  • the first server 131 In the first case, the first server 131 generates a basic configuration file for the logical device 121.
  • the specific processing procedure is as follows: the authentication request message sent by the host 111 to the first server 131 may also carry the service type of the logical device 121 to be created, such as Business Type A.
  • the first server 131 can parse the service type A from the authentication request message. Based on the correspondence between the service type A and the basic configuration file A, the basic configuration file A corresponding to the service type A can be generated for the logical device 121.
  • Case 2 The first server 131 generates a basic configuration file and a customized configuration file for the logical device 121.
  • the specific processing manners are as follows:
  • the first server 131 parses the service type from the authentication request message, and generates a basic configuration file corresponding to the service type; parses the user configuration information from the page response message, and generates a customized configuration according to the user configuration information. file.
  • the specific processing procedure is as follows: The first server 131 generates a basic configuration file A corresponding to the service type A for the logical device 121.
  • the first server 131 sends a page message to the host 111, which may carry configuration parameters.
  • the page message may include a page form, where the page form includes a device identifier of the logical device, and configuration parameters used to generate the customized configuration file, such as an interface name, an IP address, an interface VLAN, and a network address translation (NAT). Parameters, VPN (Virtual Private Network) parameters, etc., of course, there are other types of configuration parameters, which are not limited.
  • the host 111 can display the page form to the user. Based on the device identifier displayed on the page form, the user can know which logical device is to be input with the user configuration information, and input the corresponding configuration parameter in the page form.
  • User configuration information For example, the interface name is interface A, the interface IP address is 200.0.0.9, the interface VLAN is VLAN 101, the NAT parameter is to convert IP address A to IP address B, and the VPN parameter is to listen to IP network segment R and listening port X.
  • the user configuration information input by the user in the page form may further include the following: a URL that is prohibited from accessing (for example, www.aaa.com), a bandwidth limitation for performing speed limit processing, an IP address for which access is prohibited, and the like.
  • a URL that is prohibited from accessing for example, www.aaa.com
  • a bandwidth limitation for performing speed limit processing for example, an IP address for which access is prohibited, and the like.
  • IP address for which access is prohibited
  • the host 111 obtains the user configuration information and the device identifier included in the page form, and sends a page response message to the first server 131.
  • the page response message may carry the user configuration information and the device identifier.
  • the first server 131 parses the user configuration information and the device identifier from the page response message.
  • the first server 131 may generate a customized profile A for the logical device according to the user configuration information.
  • the customized configuration file A may include a deny ACL (Access Control List), such as deny 220.0. 0.5 (ie the IP address corresponding to www.aaa.com).
  • the configuration file A can include a rate limit command line, such as a CAR (Committed Access Rate) 5000 kbps.
  • the customized configuration file A may include an ACL for prohibiting the IP address from accessing the network.
  • the above process is only an example of generating a custom configuration file A, and there is no limitation thereto.
  • the second server 131 can generate the basic configuration file and the customized configuration file by sending a page message, and the specific configuration process is: the first server 131 generates the service type A for the logical device 121.
  • the first server 131 does not parse the service type from the authentication request message, but parses the service type from the page response message.
  • the first server 131 generates a customized configuration file A for the logical device 121.
  • the corresponding relationship between the device identifier abcd of the logical device 121 and the URL address of the basic configuration file A may also be recorded in the association table.
  • the corresponding relationship between the device identifier abcd of the logical device 121 and the URL address of the customized configuration file A may also be recorded in the association table.
  • the authentication request message carries the user identity information
  • the page response message carries the device identifier. Therefore, the URL address of the basic configuration file and the URL address of the customized configuration file may be recorded in the association table according to the user identity information or the device identifier. In addition, you can record the name of the underlying configuration file and the name of the custom configuration file into the association table. See Table 2 for an example of an associated table.
  • the URL address corresponding to the storage location A is also the URL address of the basic configuration file A.
  • the URL address corresponding to the storage location B is also the URL address of the basic configuration file B.
  • Step a7 After the physical device 12 creates the logical device 121, the logical device 121 may send a DHCP request message in a broadcast manner, where the DHCP request message carries a device identifier abcd, for example, a first option field of the DHCP request message (such as an Option 82 field, etc.)
  • the device identifier abcd can be carried.
  • Step a8 After receiving the DHCP request message, the first server 131 may allocate an IP address 100.100.0.0 to the logical device 121, and query the association table shown in Table 2 by using the device identifier abcd to obtain the device identifier abcd. Corresponding URL address A and URL address B.
  • Step a9 The first server 131 sends a DHCP response message to the logical device 121, where the DHCP response message carries an IP address of 100.100.0.0, a URL address A, and a URL address B.
  • the URL address A and the URL address B may be carried through a second option field of the DHCP response message (such as the Option 100 field).
  • Step a10 After receiving the DHCP response message, the logical device 121 parses the URL address A and the URL address B from the DHCP response message, and sends an FTP download request carrying the URL address A to the first server 131 to the first server 131. Send an FTP download request carrying URL address B.
  • Step a11 After receiving the FTP download request carrying the URL address A, the first server 131 may obtain the basic configuration file A from the storage location A corresponding to the URL address A, and send the basic configuration file A to the logical device 121. FTP response message. After receiving the FTP download request carrying the URL address B, the first server 131 may obtain the customized configuration file A from the storage location B corresponding to the URL address B, and send an FTP response message carrying the customized configuration file A to the logical device 121. .
  • Step a12 After receiving the FTP response message carrying the basic configuration file A, the logical device 121 parses the basic configuration file A from the FTP response message. After receiving the FTP response message carrying the customized configuration file A, the logical device 121 parses the customized configuration file A from the FTP response message.
  • Application scenario 2 is a networking diagram of another application scenario of the embodiment of the present application, where a first server and a second server are deployed, the first server is configured to provide a DHCP function, and the first server is configured.
  • the IP address of the second server may be pre-recorded, and the first server may also configure the second server as a server for providing a service profile for the logical device.
  • the second server is used to provide an authentication function and a download service function (such as an FTP service function). Based on the authentication function, the second server can authenticate the user. After the authentication is passed, the physical device is allowed to create a logical device and generate a service configuration file for the logical device.
  • the second server can send the service profile to the logical device.
  • the first server may send the address information corresponding to the service configuration file to the logical device, and the logical device uses the address information to obtain the service configuration file.
  • the method for sending a service profile in the embodiment of the present application may include the following steps:
  • Step b1 - step b7 the process flow is shown in step a1 - step a7 of the application scenario 1, the difference is that in the application scenario 1, the related operations of the steps a1 - a7 are performed by the first server 131, and in the application scenario 2 The related operations of the step b1 to the step b7 are performed by the second server 132, and details are not described herein again.
  • Step b8 After receiving the DHCP request message, the second server 132 discards the DHCP request message because it does not have the DHCP function. After receiving the DHCP request message, the first server 131 assigns an IP address 100.100.0.0 to the logical device 121 and acquires the IP address of the second server 132 because of the DHCP function.
  • Step b9 The first server 131 sends a DHCP response message to the logical device 121, where the DHCP response message carries the IP address 100.100.0.0 and the IP address of the second server 132.
  • the second option field (such as the Option 100 field) of the DHCP response message carries the IP address of the second server 132, and the IP address 100.100.0.0 is carried in the yiaddr field.
  • Step b10 After receiving the DHCP response message, the logical device 121 parses the IP address of the second server 132 from the DHCP response message, and sends the second server 132 to the second server 132 by using the IP address of the second server 132. A request message requesting a URL address, the request message carrying the device identifier abcd.
  • Step b11 The second server 132 queries the association table shown in Table 2 by using the device identifier abcd to obtain a URL address A and a URL address B corresponding to the device identifier abcd.
  • Step b12 The second server 132 sends a response message to the logical device 121, where the response message carries a URL address A and a URL address B.
  • step b13 the logical device 121 sends an FTP download request carrying the URL address A to the second server 132, and sends an FTP download request carrying the URL address B to the second server 132.
  • Step b14 After receiving the FTP download request carrying the URL address A, the second server 132 may obtain the basic configuration file A from the storage location A corresponding to the URL address A, and send the basic configuration file A to the logical device 121. FTP response message. After receiving the FTP download request carrying the URL address B, the second server 132 may obtain the customized configuration file A from the storage location B corresponding to the URL address B, and send an FTP response message carrying the customized configuration file A to the logical device 121. .
  • Step b15 After receiving the FTP response message carrying the basic configuration file A, the logical device 121 parses the basic configuration file A from the FTP response message. After receiving the FTP response message carrying the customized configuration file A, the logical device 121 parses the customized configuration file A from the FTP response message.
  • the logical device 121 sends an FTP download request to the second server 132, where the FTP download request carries the device identifier abcd.
  • the second server 132 obtains the URL address A and the URL address B by using the device identifier abcd to obtain the URL address A and the URL address B.
  • the basic configuration file A is obtained from the storage location A corresponding to the URL address A, and is sent to the logical device 121.
  • the FTP response message of the basic configuration file A obtains the customized configuration file A from the storage location B corresponding to the URL address B, and sends an FTP response message carrying the customized configuration file A to the logical device 121.
  • the logical device 121 can also acquire the basic configuration file A and the customized configuration file A.
  • the basic configuration file and/or the customized configuration file of the logical device may be modified, and the host may be the first server 131/the second server 132 (the first server 131 in the application scenario 1 is In the application scenario 2, the second server 132) sends a profile change message.
  • the configuration file change message may carry the user identity information and the modified service type. If the customized configuration file of the logical device is modified, the configuration file change message may carry the user identity information and the modified user configuration information. If the basic configuration file and the customized configuration file of the logical device are modified, the configuration file change message may carry the user identity information, the modified service type, and the modified user configuration information.
  • the first server 131 / the second server 132 can also receive the profile change message sent by the host. If the configuration file change message carries the modified service type, generating a new basic configuration file corresponding to the modified service type for the logical device; and/or, if the configuration file change message carries the modified user configuration information, Generate a new custom configuration file for the logical device based on the modified user configuration information. Then, the correspondence between the device identifier of the logical device and the URL address of the new basic profile, and/or the URL address of the new custom profile may be recorded in the association table.
  • the triggering host 111 sends a configuration file change message to the first server 131/second server 132, and the configuration file change message can be carried.
  • User identity information, service type B such that the first server 131 / the second server 132 can generate a basic configuration file B for the logical device 121, and record the device identification (such as abcd) and the basic configuration file B of the logical device 121 in the association table.
  • the first server 131 / the second server 132 may determine the device identifier (eg, abcd) based on the user identity information carried in the configuration file change message.
  • the triggering host 111 redisplays the page form to the user, and the user can input the changed user configuration information in the page form. For example, you can change the interface VLAN from VLAN 101 to VLAN 102, and you can delete the NAT parameters in the page form. The other user configuration information of the page form does not change.
  • the triggering host 111 sends a configuration file change message to the first server 131/second server 132, where the configuration file change message may carry the user identity information and the changed user configuration information, and the first server 131/second server 132 may be configured according to
  • the changed user configuration information regenerates the customized configuration file, and records the correspondence between the device identifier of the logical device 121 and the new customized configuration file in the association table.
  • step a7-step a12 is re-executed
  • step b7-step b15 is re-executed
  • the new basic configuration file and/or the new customized configuration file may be sent to the logical device 121.
  • the logical device 121 updates its own base configuration file and/or custom configuration file.
  • a new basic configuration file and/or a customized configuration file may be generated at the first server 131 / the second server 132, and then the logical device 121 may be The basic configuration file and/or custom configuration file is updated to a new basic configuration file and/or a customized configuration file to achieve more automation and intelligence, and improve the user's business experience.
  • the first server 131/second server 132 may not delete the existing basic configuration file and/or the customized configuration file, ie, the storage logical device 121. Multiple base profiles and/or custom profiles.
  • FIG. 4 is a structural block diagram of an apparatus for delivering a service profile according to an embodiment of the present application.
  • the apparatus for sending a service profile in the embodiment of the present application may be applied to the first server, and may specifically include a receiving module 401, a determining module 402, and a sending module 403.
  • the description of each module is as follows.
  • the receiving module 401 is configured to receive a DHCP request message sent by the logical device, where the logical device is created on the physical device.
  • the determining module 402 is configured to determine address information corresponding to the service profile of the logical device.
  • the sending module 403 is configured to send a DHCP response message carrying the address information to the logical device, so that the logical device acquires a service configuration file according to the address information in the DHCP response message.
  • the determining module 402 is specifically configured to obtain an IP address of the second server, where the second server provides a service configuration file for the logical device, and the second server The IP address is determined to be address information corresponding to the service profile of the logical device.
  • the determining module 402 specifically parses the device identifier of the logical device from the DHCP request message, and queries the association table by using the device identifier to obtain the device identifier. a URL address of the corresponding service profile, and the URL address is determined as the address information corresponding to the service profile of the logical device; wherein the association table is used to record the device identifier of the logical device and the service profile The correspondence between URL addresses.
  • FIG. 5 is a structural block diagram of another apparatus for delivering a service profile according to an embodiment of the present application.
  • the apparatus for delivering a service profile further includes: a generating module 404.
  • the receiving module 401 is further configured to receive an authentication request message sent by the host, where the authentication request message carries user identity information.
  • the determining module 402 is further configured to: if the user identity information is authenticated, assign a device identifier to the logical device to be created, and obtain a user authorization level corresponding to the user identity information, and determine the user authorization level. Corresponding physical resource information.
  • the sending module 403 is further configured to send a creation message to the physical device corresponding to the user identity information, where the creation message carries the device identifier and the physical resource information, so that the physical device utilizes the The device identifier and the physical resource information create the logical device.
  • the generating module 404 is configured to generate a service configuration file for the logical device, and determine a URL address corresponding to a storage location of the service configuration file, where the device identifier and the service configuration file are recorded in an association table. The correspondence between URL addresses.
  • the generating module 404 is specifically configured to parse the service type from the authentication request message, and generate the service with the service for the logical device.
  • the underlying configuration file for the type is specifically configured to parse the service type from the authentication request message, and generate the service with the service for the logical device.
  • FIG. 6 is a structural block diagram of another apparatus for delivering a service profile according to an embodiment of the present application.
  • the apparatus for delivering a service profile further includes: an obtaining module 405.
  • the receiving module 401 is further configured to receive a download request message sent by the logical device, where the download request message carries a URL address of a service configuration file corresponding to the device identifier.
  • the obtaining module 405 is configured to obtain a service configuration file corresponding to the logical device from a storage location corresponding to the URL address, and send a download response message to the logical device, where the download response message carries the service configuration file.
  • the receiving module 401 is further configured to receive a configuration file change message sent by the host.
  • the generating module 404 is further configured to: if the configuration file change message carries the modified service type, generate a new basic configuration file corresponding to the modified service type for the logical device; and/or, if And the configuration file change message carries the modified user configuration information, and generates a new customized configuration file for the logical device according to the modified user configuration information;
  • the service configuration file can be automatically sent to the logical device (such as a logical firewall), instead of manually assigning a service configuration file to the logical device by the administrator, thereby reducing the workload of the administrator and avoiding service configuration. File error.
  • FIG. 7 is a structural block diagram of a server provided by an embodiment of the present application.
  • the server includes a processor 701 and a machine readable storage medium 702 storing machine executable instructions executable by the processor 701, the machine executable instructions comprising: a first receive instruction 712, a first The instruction 722 and the first sending instruction 732 are determined.
  • the processor 701 is caused by the first receiving instruction 712 to implement: receiving a DHCP request message sent by the logical device, the logical device being created on the physical device.
  • the processor 701 is caused by the first determining instruction 722 to: determine address information corresponding to a service profile of the logical device.
  • the processor 701 is caused by the first sending instruction 732 to: send a DHCP response message carrying the address information to the logical device, so that the logical device acquires the location information according to the address information in the DHCP response message.
  • the business profile of the logical device is caused by the first sending instruction 732 to: send a DHCP response message carrying the address information to the logical device, so that the logical device acquires the location information according to the address information in the DHCP response message.
  • the processor 701 is caused by the first determining instruction 722 to implement a specific implementation:
  • the IP address of the second server is determined as address information corresponding to a service profile of the logical device.
  • the DHCP request message carries the device identifier of the logical device, and the processor 701 is specifically implemented by the first determining instruction 722:
  • Parsing the device identifier of the logical device from the DHCP request message querying the association table by using the device identifier, obtaining a URL address of the service configuration file corresponding to the device identifier, and determining the URL address as The address information corresponding to the service configuration file of the logical device, where the association table is used to record the correspondence between the device identifier of the logical device and the URL address of the service configuration file.
  • the machine executable instructions further include: a second receiving instruction, a second determining instruction, a second sending instruction, and a first generating instruction.
  • the processor 701 is caused by the second receiving instruction to: receive an authentication request message sent by the host, where the authentication request message carries user identity information.
  • the processor 701 is caused by the second determining instruction to: when the user identity information is authenticated, assign a device identifier to the logical device to be created, and obtain a user authorization level corresponding to the user identity information, and determine Physical resource information corresponding to the user authorization level.
  • the processor 701 is caused by the second sending instruction to: send a creation message to the physical device corresponding to the user identity information, where the creation message carries the device identifier and the physical resource information, so that the The physical device creates the logical device by using the device identifier and the physical resource information.
  • the processor 701 is caused by the first generation instruction to: generate a service configuration file for the logical device, and determine a URL address corresponding to a storage location of the service configuration file, and record the device identifier in an association table. Correspondence with the URL address of the service profile.
  • the processor 701 when the service profile includes a basic profile, the processor 701 is caused by the first generation instruction to implement:
  • the processor 701 is caused by the first generation instruction to implement:
  • the machine executable instructions further include: a third receiving instruction, an obtaining instruction.
  • the processor 701 is configured to be implemented by the third receiving instruction: receiving a download request message sent by the logical device, where the download request message carries a URL address of a service configuration file corresponding to the device identifier.
  • the processor 701 is caused by the obtaining instruction to: obtain a service configuration file corresponding to the logical device from a storage location corresponding to the URL address, and send a download response message to the logical device, where the download response message is sent Carry the service profile.
  • the machine executable instructions further include: a fourth receiving instruction and a second generating instruction.
  • the processor 701 is caused by the fourth receiving instruction to: receive a configuration file change message sent by the host.
  • the processor 701 is caused by the second generation instruction to implement, if the configuration file change message carries the modified service type, generating a new basic configuration file corresponding to the modified service type for the logical device; And/or, if the configuration file change message carries the modified user configuration information, generating a new customized configuration file for the logical device according to the modified user configuration information;
  • the server may further include a communication bus 703.
  • the processor 701 and the machine-readable storage medium 702 complete communication with each other through the communication bus 703, which may be a Peripheral Component Interconnect (PCI) bus. Or extend the Industrial Standard Architecture (EISA) bus.
  • the communication bus 703 can be divided into an address bus, a data bus, a control bus, and the like.
  • the machine-readable storage medium 702 may include a random access memory (RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage. Additionally, machine-readable storage medium 702 can also be at least one storage device located remotely from the aforementioned processor.
  • RAM random access memory
  • NVM non-volatile memory
  • machine-readable storage medium 702 can also be at least one storage device located remotely from the aforementioned processor.
  • the processor 701 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; or may be a digital signal processing (DSP), an application specific integrated circuit. (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.
  • CPU central processing unit
  • NP network processor
  • DSP digital signal processing
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • the embodiment of the present application further provides a machine readable storage medium.
  • the machine readable storage medium can be located on a server, the machine readable storage medium storing machine executable instructions comprising: a first received instruction, a first determined instruction, a first transmitted instruction.
  • the first receiving instruction when invoked and executed by the processor, causes the processor to implement: receiving a DHCP request message sent by the logical device, the logical device being created on the physical device.
  • the first determining instruction when invoked and executed by the processor, causes the processor to: determine address information corresponding to a service profile of the logical device.
  • the first sending instruction causes the processor to: send a DHCP response message carrying the address information to the logical device, so that the logical device according to the DHCP response message
  • the address information in the middle acquires the service configuration file of the logical device.
  • the processor is caused by the first determining instruction to implement a specific implementation:
  • the IP address of the second server is determined as address information corresponding to a service profile of the logical device.
  • the DHCP request message carries a device identifier of the logical device
  • the processor is specifically implemented by the first determining instruction:
  • Parsing the device identifier of the logical device from the DHCP request message querying the association table by using the device identifier, obtaining a URL address of the service configuration file corresponding to the device identifier, and determining the URL address as The address information corresponding to the service configuration file of the logical device, where the association table is used to record the correspondence between the device identifier of the logical device and the URL address of the service configuration file.
  • the machine executable instructions further include: a second receiving instruction, a second determining instruction, a second sending instruction, and a first generating instruction.
  • the processor is caused by the second receiving instruction to: receive an authentication request message sent by the host, where the authentication request message carries user identity information.
  • the processor is caused to be implemented by the second determining instruction: if the user identity information is authenticated, assigning a device identifier to the logical device to be created, and acquiring a user authorization level corresponding to the user identity information, determining and The physical resource information corresponding to the user authorization level.
  • the processor is caused by the second sending instruction to: send a creation message to the physical device corresponding to the user identity information, where the creation message carries the device identifier and the physical resource information, so that the The physical device creates the logical device using the device identification and the physical resource information.
  • the processor is caused to be implemented by the first generation instruction: generating a service configuration file for the logical device, and determining a URL address corresponding to a storage location of the service configuration file, and recording the device identifier in an association table The correspondence between the URL addresses of the service profiles.
  • the processor when the service profile includes a basic profile, the processor is caused by the first generation instruction to implement:
  • the processor is caused by the first generation instruction to implement:
  • the machine executable instructions further include: a third receiving instruction, an acquiring instruction;
  • the processor is caused to be implemented by the third receiving instruction: receiving a download request message sent by the logical device, where the download request message carries a URL address of a service configuration file corresponding to the device identifier;
  • the obtaining by the acquiring instruction, the obtaining: obtaining a service configuration file corresponding to the logical device from a storage location corresponding to the URL address, and sending a download response message to the logical device, where the download response message carries The service profile.
  • the machine executable instructions further include: a fourth receiving instruction, a second generating instruction;
  • the processor is caused to be implemented by the fourth receiving instruction: receiving a configuration file change message sent by the host;
  • the processor is caused to be implemented by the second generating instruction: if the configuration file change message carries the modified service type, generating a new basic configuration file corresponding to the modified service type for the logical device; And/or, if the configuration file change message carries the modified user configuration information, generating a new customized configuration file for the logical device according to the modified user configuration information;
  • the service configuration file can be automatically sent to the logical device (such as a logical firewall), instead of manually assigning a service configuration file to the logical device by the administrator, thereby reducing the workload of the administrator and avoiding service configuration. File error.
  • the device, the server, and the machine-readable storage medium are similar to the method embodiment of the service configuration file, and the description is relatively simple. A partial description of the method embodiment of the file is sufficient.
  • embodiments of the embodiments of the present application can be provided as a method, apparatus, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • Embodiments of the present application are described with reference to flowcharts and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG.
  • These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing terminal device to produce a machine such that instructions are executed by a processor of a computer or other programmable data processing terminal device
  • Means are provided for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the instruction device implements the functions specified in one or more blocks of the flow or in a flow or block diagram of the flowchart.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Automation & Control Theory (AREA)
  • Information Transfer Between Computers (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种下发业务配置文件的方法和相应的一种下发业务配置文件的装置，该方法包括：接收逻辑设备发送的DHCP请求消息，该逻辑设备在物理设备上创建；确定与所述逻辑设备的业务配置文件对应的地址信息；向所述逻辑设备发送携带所述地址信息的DHCP响应消息，以使所述逻辑设备根据所述DHCP响应消息中的地址信息获取所述逻辑设备的业务配置文件。通过本申请实施例，可以减轻管理员的工作量，并避免配置文件的错误。

Description

下发业务配置文件
相关申请的交叉引用
本申请要求于2017年8月24日提交中国专利局、申请号为201710734609.5发明名称为“一种业务配置文件下发方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
背景技术
在MDC(Multitenant Device Context，多租户设备环境)组网中，可以通过虚拟化技术将一个物理设备(如物理防火墙)划分成多个逻辑设备(如逻辑防火墙)，每个逻辑防火墙都是独立运行的防火墙，具有自己专属的软硬件资源。在创建、启动、重启、删除一个逻辑防火墙时，不会影响其它逻辑防火墙的运行。由于可以将一个物理防火墙划分成多个逻辑防火墙，因此，可以有效节省部署成本，提高组网灵活性，方便管理和维护，并有效减少了管理和维护成本。
附图简要说明
图1A是本申请实施例提供的一种下发业务配置文件的方法的流程图；
图1B是本申请实施例提供的另一种下发业务配置文件的方法的流程图；
图1C是本申请实施例提供的另一种下发业务配置文件的方法的流程图；
图2是本申请实施例提供的一种页面表单的示意图；
图3A是本申请实施例提供的一种应用场景示意图；
图3B是本申请实施例提供的另一种应用场景示意图；
图4是本申请实施例提供的一种下发业务配置文件的装置的结构框图；
图5是本申请实施例提供的一种下发业务配置文件的装置的结构框图；
图6是本申请实施例提供的一种下发业务配置文件的装置的结构框图；
图7是本申请实施例提供的一种服务器的硬件结构框图。
具体实施方式
为使本申请的上述目的、特征和优点能够更加明显易懂，下面结合附图 和具体实施方式对本申请作进一步详细的说明。
在MDC(Multitenant Device Context，多租户设备环境)组网中，可以通过虚拟化技术将一个物理设备(如物理防火墙)划分成多个逻辑设备(如逻辑防火墙)，每个逻辑防火墙都是独立运行的防火墙，具有自己专属的软硬件资源。并且，在创建、启动、重启、删除一个逻辑防火墙时，不会影响其它逻辑防火墙的运行。由于可以将一个物理防火墙划分成多个逻辑防火墙，因此，可以有效节省部署成本，提高组网灵活性，方便管理和维护，并有效减少了管理和维护成本。
现有技术中，在将一个物理防火墙划分成多个逻辑防火墙时，管理员需要手动为每个逻辑防火墙分配CPU(Central Processing Unit，中央处理器)、磁盘、内存等资源，并且手动为每个逻辑防火墙下发业务配置文件。本申请的发明人发现：基于现有的配置方式，管理员工作量很大，而且容易出现错误。
本申请实施例提出一种下发业务配置文件的方法，该方法可以应用于MDC系统，MDC系统可以包括物理设备和第一服务器，通过虚拟化技术，可以将物理设备虚拟出至少一个逻辑设备。以物理设备是物理防火墙，逻辑设备是逻辑防火墙为例，每个逻辑防火墙都是独立运行的防火墙，具有自己专属的软硬件资源，在创建、启动、重启、删除一个逻辑防火墙时，不会影响其它逻辑防火墙的运行。
基于本申请实施例提的一种下发业务配置文件的方法，第一服务器接收逻辑设备发送的DHCP请求消息后，可以确定与该逻辑设备的业务配置文件对应的地址信息，然后向该逻辑设备发送携带该地址信息的DHCP响应消息，以使该逻辑设备根据DHCP响应消息中的地址信息获取该逻辑设备的业务配置文件，从而实现自动下发配置文件，无需管理员手动为每个逻辑防火墙下发业务配置文件，可以减轻管理员的工作量，并避免配置文件的错误。
参见图1A所示，为下发业务配置文件的方法的流程图，该方法可以应用于第一服务器，该第一服务器可以是DHCP(Dynamic Host Configuration Protocol，动态主机配置协议)服务器。该方法可以包括以下步骤。
步骤101，接收逻辑设备发送的DHCP请求消息，该逻辑设备在物理设备 上创建。
步骤102，确定与该逻辑设备的业务配置文件对应的地址信息。
步骤103，向该逻辑设备发送携带该地址信息的DHCP响应消息，以使该逻辑设备根据DHCP响应消息中的地址信息获取该逻辑设备的业务配置文件。
为了将业务配置文件下发给逻辑设备，可以涉及两个过程，第一个过程是，为逻辑设备生成业务配置文件，将业务配置文件发送给逻辑设备，第二个过程是，将业务配置文件对应的地址信息发送给逻辑设备，以使逻辑设备利用该地址信息获取业务配置文件。上述两个过程可以均由第一服务器执行。上述两个过程也可以由不同服务器执行，第一个过程由第二服务器执行，第二个过程由第一服务器执行。其中，第二服务器可以是MDC组网中，不具有DHCP功能的任一服务器，同时，第二服务器可以具有为逻辑设备生成业务配置文件、以及身份认证等功能。
假设由第一服务器和第二服务器执行上述两个过程，第一服务器上可以预先记录有第二服务器的IP地址，第二服务器为逻辑设备提供业务配置文件，第一服务器可以将第二服务器配置为用于为逻辑设备提供业务配置文件的服务器。当第二服务器检测到在物理设备上创建逻辑设备时，第二服务器可以为逻辑设备生成业务配置文件，具体的处理过程后面会进行详细说明。在物理设备上创建逻辑设备后，逻辑设备没有任何配置信息，也没有第二服务器的地址信息，无法直接从第二服务器获取业务配置文件。基于此，逻辑设备可以采用广播方式发送DHCP请求消息。第二服务器在接收到DHCP请求消息后，由于第二服务器不具有DHCP功能，因此丢弃DHCP请求消息。第一服务器在接收到DHCP请求消息后，由于第一服务器具有DHCP功能，因此可以处理该DHCP请求消息。
第一服务器在接收到DHCP请求消息后，可以为逻辑设备分配IP地址。在此基础上，由于第一服务器上预先记录有第二服务器的IP地址，因此，第一服务器在接收到DHCP请求消息后，可以获取第二服务器的IP地址，将第二服务器的IP地址确定为该逻辑设备的业务配置文件对应的地址信息。然后，第一服务器向逻辑设备发送携带该地址信息的DHCP响应消息，该DHCP响应消息除了携带第二服务器的IP地址，还可以携带为逻辑设备分配的IP地址。
逻辑设备在接收到该DHCP响应消息后，可以从该DHCP响应消息中解析出该地址信息，并从该地址信息对应的第二服务器获取业务配置文件。
假设由第一服务器执行上述两个过程，则第一服务器可以为逻辑设备生成业务配置文件，并记录与该业务配置文件的存储位置对应的URL(Uniform Resource Locator，统一资源定位符)地址，第一服务器在接收到DHCP请求消息后，可以为逻辑设备分配IP地址。在此基础上，第一服务器还可以从本地查询与该业务配置文件的存储位置对应的URL地址，并将该URL地址确定为业务配置文件对应的地址信息。然后，第一服务器向逻辑设备发送携带该地址信息的DHCP响应消息，该DHCP响应消息除了携带该URL地址，还可以携带为逻辑设备分配的IP地址。
逻辑设备在接收到该DHCP响应消息后，可以从该DHCP响应消息中解析出该地址信息(即与业务配置文件的存储位置对应的URL地址)，并从该URL地址对应的存储位置获取业务配置文件。
本申请实施例以第一服务器执行上述两个过程为例，对步骤101～步骤103的处理过程进行详细说明，具体的处理流程可以参见图1B所示。
步骤111，第一服务器接收主机发送的认证请求消息。
其中，该认证请求消息可以携带用户的用户身份信息，用户的用户身份信息可以包括用户名和密码。
若基于该用户身份信息确定通过认证，则执行步骤112；若基于该用户身份信息确定未通过认证，则向主机返回认证失败消息，以通过认证为例进行说明。
本申请实施例中，局域网中的用户可以在第一服务器中注册用户名和密码，例如，注册用户名“AA”和密码“123456”。第一服务器还可以配置用户授权等级。其中，用户授权等级与用户购买服务有关，对于用户授权等级分配方式，对此不做限制。基于上述信息，第一服务器可以维护关联表。该关联表可以用于记录用户名、密码、用户授权等级等信息，还可以记录设备标识、业务配置文件和业务配置文件对应的地址信息等。在初始状态下，关联表可以如表1所示。
表1
Figure PCTCN2018102196-appb-000001
当某用户需要创建逻辑设备时，该用户可以通过主机向第一服务器发送认证请求消息，该认证请求消息携带用户身份信息。第一服务器接收到主机发送的认证请求消息后，可以基于该用户身份信息进行身份认证，如果确定用户身份信息通过认证，则执行步骤112；如果确定用户身份信息未通过认证，则向主机返回认证失败消息。以通过认证为例进行说明。
例如，若表1所示的关联表中存在用户1的用户身份信息，则该用户身份信息通过认证；若表1所示的关联表中不存在用户1的用户身份信息，则该用户身份信息未通过认证，向主机111返回认证失败消息。
本申请实施例中，用户还可以选择逻辑设备的业务类型，该业务类型可以包括但不限于：IPS(Intrusion Prevention System，入侵防御系统)类型、AV(防毒墙)类型等，对此业务类型不做限制。主机接收到用户输入的选择指令，该选择指令携带业务类型，主机可以将该业务类型添加到认证请求消息中，即认证请求消息中还可以携带逻辑设备的业务类型。例如，主机可以将该业务类型的标识添加到认证请求消息中。
步骤112，第一服务器为待创建的逻辑设备分配设备标识，并获取与该用户身份信息对应的用户授权等级，确定与该用户授权等级对应的物理资源信息；向该用户身份信息对应的物理设备发送创建消息，该创建消息携带该设 备标识和该物理资源信息，以使物理设备利用该设备标识和该物理资源信息创建逻辑设备。
其中，物理资源信息是逻辑设备启动时的必备资源的信息，例如，物理资源信息可以包括但不限于以下之一或者任意组合：硬件资源(如磁盘等)、CPU、内存、最大吞吐量、会话数等。
本申请实施例中，第一服务器在确定用户身份信息通过认证后，第一服务器可以为待创建的逻辑设备分配设备标识。
本申请实施例中，第一服务器在确定用户身份信息通过认证后，还可以根据该用户身份信息，在关联表中查询该用户身份信息对应的用户授权等级，进而可以根据预设的用户授权等级和物理资源信息的对应关系，确定与该用户授权等级对应的物理资源信息。其中，用户授权等级和物理资源信息的对应关系可以由技术人员进行配置。
第一服务器还可以维护用户授权等级与物理资源信息的对应关系，如用户授权等级1与物理资源信息1的对应关系，用户授权等级2与物理资源信息2的对应关系，以此类推。第一服务器可以在关联表中维护用户身份信息与物理设备的对应关系，表1并未示出这一对应关系。基于此对应关系，第一服务器可以确定与该用户身份信息对应的物理设备，该用户身份信息为认证请求消息中携带的用户身份信息。然后，第一服务器可以向该物理设备发送创建消息。其中，该创建消息携带设备标识和物理资源信息。
物理设备在接收到创建消息后，可以从创建消息中解析出设备标识和物理资源信息，然后，物理设备利用该设备标识和该物理资源信息创建逻辑设备。
步骤113，第一服务器为该逻辑设备生成业务配置文件，并确定与该业务配置文件的存储位置对应的URL地址，在关联表中记录该逻辑设备的设备标识与该逻辑设备的业务配置文件的URL地址的对应关系。
其中，业务配置文件可以包括但不限于基础配置文件和/或定制配置文件。
基础配置文件与业务类型有关，相同业务类型的逻辑设备可以使用相同的基础配置文件，不同业务类型的逻辑设备可以使用不同的基础配置文件。 第一服务器可以存储各业务类型的基础配置文件，如业务类型A对应的基础配置文件A，业务类型B对应的基础配置文件B等。对于各基础配置文件的生成方式，将在下文中描述，在此不再赘述。
定制配置文件可以包括逻辑设备的个性配置，如ACL、限速阈值等，定制配置文件与用户的需求有关，即可以根据用户的需求生成定制配置文件。
第一服务器可以为该逻辑设备生成业务配置文件，然后对该业务配置文件进行存储，记录与该业务配置文件的存储位置对应的URL地址。第一服务器可以在关联表中记录该逻辑设备的设备标识与该URL地址的对应关系，该URL地址即为该逻辑设备的业务配置文件的URL地址。
当业务配置文件包括基础配置文件时，针对为该逻辑设备生成业务配置文件的过程，可以包括但不限于：第一服务器从该认证请求消息中解析出业务类型，并为该逻辑设备生成与该业务类型对应的基础配置文件。
当业务配置文件包括基础配置文件和定制配置文件时，针对为该逻辑设备生成业务配置文件的过程，可以包括但不限于如下方式：
方式一、第一服务器从该认证请求消息中解析出业务类型，并生成与该业务类型对应的基础配置文件；从页面响应消息中解析出用户配置信息，并根据该用户配置信息生成定制配置文件。具体的处理过程为：第一服务器从该认证请求消息中解析出业务类型，并为该逻辑设备生成与该业务类型对应的基础配置文件。向主机发送携带配置参数的页面消息，以使该主机获取与该配置参数对应的用户配置信息；然后，接收该主机发送的页面响应消息，该页面响应消息携带所述用户配置信息，并根据该用户配置信息为该逻辑设备生成定制配置文件。
本申请实施例中，认证请求消息还可以携带待创建的逻辑设备的业务类型。第一服务器可以从认证请求消息中解析出该业务类型，然后，根据预设的业务类型与基础配置文件的对应关系，生成与该业务类型对应的基础配置文件。
第一服务器还可以向主机发送携带配置参数的页面消息，该页面消息可以包括页面表单，该页面表单包括逻辑设备的设备标识、用于生成定制配置文件的配置参数，如接口名称、IP地址、接口VLAN、NAT(Network Address  Translation，网络地址转换)参数、VPN(Virtual Private Network，虚拟专用网络)参数等，当然，还可以有其它类型的配置参数，对此不做限制。如图2所示，为本申请实施例提供的一种页面表单的示意图。
主机在接收到页面消息后，可以将该页面表单显示给用户。基于页面表单显示的设备标识，用户可以获知将要为哪个逻辑设备输入用户配置信息，并在该页面表单输入与配置参数对应的用户配置信息。例如，接口名称为接口A、接口IP地址为200.0.0.9、接口VLAN是VLAN101、NAT参数是将IP地址A转换为IP地址B、VPN参数是监听IP网段R和监听端口X等。此外，用户在该页面表单输入的用户配置信息还可以包括以下内容：禁止访问的网址(例如www.aaa.com)、用于进行限速处理的带宽限制、禁止访问的IP地址等。当然，上述用户配置信息只是一个示例，对此用户配置信息的内容不做限制。
主机获取用户配置信息和页面表单包括的设备标识，并向第一服务器发送页面响应消息，该页面响应消息携带用户配置信息、设备标识。第一服务器在接收到该页面响应消息后，从该页面响应消息中解析出用户配置信息和设备标识。
第一服务器可以根据该用户配置信息为逻辑设备生成定制配置文件。例如，针对“禁止访问的网址(例如www.aaa.com)”这个用户配置信息，定制配置文件A中可以包括一条deny(拒绝)的ACL(Access Control List，访问控制列表)，如deny 220.0.0.5(即www.aaa.com对应的IP地址)。针对“用于进行限速处理的带宽限制”这个用户配置信息，定制配置文件A中可以包括限速命令行，如CAR(Committed Access Rate，承诺访问数率)5000kbps等。针对“禁止访问的IP地址”这个用户配置信息，定制配置文件A中可以包括禁止该IP地址访问网络的ACL。当然，上述过程只是生成定制配置文件A的示例，对此不做限制。
方式二、第一服务器可以通过发送页面消息，获取业务类型和用户配置信息，从而生成基础配置文件和定制配置文件。具体的处理过程为：向主机发送携带配置参数的页面消息，以使主机获取业务类型、与该配置参数对应的用户配置信息；然后，接收主机发送页面响应消息，该页面响应消息携带该业务类型和该用户配置信息，为该逻辑设备生成与该业务类型对应的基础配置文件，并根据该用户配置信息为该逻辑设备生成定制配置文件。
本申请实施例中，当认证请求消息中未携带业务类型时，第一服务器可以向主机发送页面消息，该页面消息携带配置参数。
主机在接收到页面消息后，可以将该页面表单显示给用户。基于页面表单显示的设备标识，用户可以获知需要为哪个逻辑设备输入用户配置信息，并在该页面表单输入与配置参数对应的用户配置信息、以及该逻辑设备的业务类型。例如，接口名称为接口A、接口IP地址为200.0.0.9、接口VLAN是VLAN101、NAT参数是将IP地址A转换为IP地址B、VPN参数是监听IP网段R和监听端口X等，业务类型为IPS类型。此外，用户在该页面表单输入的用户配置信息还可以包括以下内容：禁止访问的网址(例如www.aaa.com)、用于进行限速处理的带宽限制、禁止访问的IP地址等。当然，上述用户配置信息只是一个示例，对此用户配置信息的内容不做限制。
主机获取用户配置信息、业务类型和页面表单包括的设备标识，并向第一服务器发送页面响应消息，该页面响应消息携带用户配置信息、业务类型和设备标识。第一服务器在接收到该页面响应消息后，从该页面响应消息中解析出用户配置信息、业务类型和设备标识。然后，第一服务器根据该业务类型，为该逻辑设备生成与该业务类型对应的基础配置文件，并根据该用户配置信息为该逻辑设备生成定制配置文件。
本申请实施例中，第一服务器可以将基础配置文件的URL地址和定制配置文件的URL地址，记录到关联表中该用户身份信息对应的表项中。此外，还可以将基础配置文件的名称和定制配置文件的名称，记录到关联表中该用户身份信息对应的表项中。
另外，上述步骤112和步骤113没有先后顺序关系，对此顺序不做限制。
步骤114，第一服务器接收逻辑设备发送的DHCP请求消息。
本申请实施例中，物理设备利用该设备标识和该物理资源信息创建逻辑设备后，逻辑设备没有任何配置信息，也没有第一服务器的地址信息，无法直接从第一服务器获取业务配置文件。基于此，逻辑设备可以采用广播方式发送DHCP请求消息，该DHCP请求消息携带该逻辑设备的设备标识，如该DHCP请求消息的第一选项字段(如Option 82字段等)可以携带该逻辑设备的设备标识。
步骤115，第一服务器确定与该逻辑设备的业务配置文件对应的地址信息。
本申请实施例中，第一服务器在接收到该DHCP请求消息后，由于第一服务器具有DHCP功能，因此，可以处理该DHCP请求消息，即为逻辑设备分配IP地址。
在此基础上，第一服务器还可以从DHCP请求消息中解析出逻辑设备的设备标识，并通过该设备标识查询关联表，得到与该设备标识对应的业务配置文件的URL地址，并将该URL地址确定为与该逻辑设备的业务配置文件对应的地址信息。
步骤116，第一服务器向该逻辑设备发送携带该地址信息的DHCP响应消息。
其中，该地址信息为业务配置文件的URL地址。
例如，可以通过DHCP响应消息的第二选项字段(如Option100字段)携带该地址信息。此外，该DHCP响应消息除了携带该地址信息，还可以携带第一服务器为逻辑设备分配的IP地址。
逻辑设备在接收到DHCP响应消息后，从该DHCP响应消息中解析出业务配置文件对应的地址信息，根据该地址信息获取业务配置文件。
具体的，针对图1B所示处理流程，逻辑设备根据该地址信息获取业务配置文件的处理过程可以为：逻辑设备可以向第一服务器发送下载请求消息，该下载请求消息携带该地址信息。第一服务器在接收到该下载请求消息后，从下载请求消息中解析出该地址信息，即业务配置文件的URL地址，并从与该URL地址对应的存储位置获取与该逻辑设备对应的业务配置文件，然后向逻辑设备发送下载响应消息，该下载响应消息携带该业务配置文件。逻辑设备可以从下载响应消息中获得该业务配置文件，然后加载该业务配置文件，以完成自身的配置。这样，逻辑设备可以自动加载业务配置文件，完成自身的配置，无需管理员手动配置，可以减轻管理员的工作量，提高配置逻辑设备的效率。
其中，第一服务器向逻辑设备提供的下载服务功能，可以是采用FTP(File Transfer Protocol，文件传输协议)的下载服务功能，当然，也可以是其它类 型的下载服务功能，对此不做限定。
假设由第一服务器和第二服务器共同执行上述下发业务配置文件的方法，则各用户可以在第二服务器进行注册，第二服务器中可以维护表1所示的关联表。
当由第一服务器和第二服务器共同执行上述下发业务配置文件的方法时，具体的处理流程可以参见图1C所示。
其中，步骤111’-步骤113’，处理流程参见图1B所示的处理流程中的步骤111-步骤113，其区别在于：在图1B中，步骤111-步骤113的相关处理是第一服务器执行，而在图1C中，步骤111’-步骤113’的相关处理是第二服务器执行，在此不再赘述。
步骤114’、第一服务器和第二服务器均接收到DHCP请求消息。
由于第二服务器不具有DHCP功能，因此第二服务器丢弃该DHCP请求消息。第一服务器在收到DHCP请求消息后，由于第一服务器具有DHCP功能，因此第一服务器可以响应该DHCP请求消息。
步骤115’、第一服务器确定与该逻辑设备的业务配置文件对应的地址信息。
本申请实施例中，第一服务器上可以预先记录有第二服务器的IP地址，并且，第一服务器可以将第二服务器配置为用于为逻辑设备提供业务配置文件的服务器。第一服务器在接收到DHCP请求消息后，可以为逻辑设备分配IP地址。在此基础上，由于第一服务器上预先记录有第二服务器的IP地址，因此，第一服务器在接收到DHCP请求消息后，还可以从本地查询到第二服务器的IP地址，并将第二服务器的IP地址确定为业务配置文件对应的地址信息。
步骤116’、第一服务器向该逻辑设备发送携带该地址信息的DHCP响应消息。
其中，该地址信息为第二服务器的IP地址。
例如，可以通过DHCP响应消息的第二选项字段(如Option100字段)携带该地址信息。此外，该DHCP响应消息除了携带该地址信息，还可以携带第一服务器为逻辑设备分配的IP地址，例如，可以通过以yiaddr(中文：你的IP地址)字段携带该IP地址。
逻辑设备在接收到DHCP响应消息后，从该DHCP响应消息中解析出业务配置文件对应的该地址信息，根据该地址信息获取业务配置文件。
具体的，该应用场景，逻辑设备根据该地址信息获取业务配置文件的处理过程可以为：逻辑设备根据第二服务器的IP地址，向第二服务器发送用于请求URL地址的请求消息，该请求消息携带设备标识。第二服务器接收到该请求消息后，解析该请求消息，获得该设备标识。第二服务器通过该设备标识查询关联表，得到与该设备标识对应的URL地址。第二服务器向逻辑设备发送响应消息，该响应消息携带该URL地址。逻辑设备向第二服务器发送下载请求消息，该下载请求消息携带该URL地址。第二服务器在接收到该下载请求消息后，从该下载请求消息中解析出该地址信息，即业务配置文件的URL地址，并从与该URL地址对应的存储位置获取与该逻辑设备对应的业务配置文件，然后向逻辑设备发送下载响应消息，该下载响应消息携带该业务配置文件。逻辑设备可以从下载响应消息中获得该业务配置文件，然后加载该业务配置文件，以完成自身的配置。这样，逻辑设备可以自动加载业务配置文件，完成自身的配置，无需管理员手动配置，可以减轻管理员的工作量，提高配置逻辑设备的效率。其中，第二服务器向逻辑设备提供的下载服务功能，可以是采用FTP(File Transfer Protocol，文件传输协议)的下载服务功能，当然，也可以是其它类型的下载服务功能，对此不做限定。
基于上述技术方案，本申请实施例中，可以自动将业务配置文件发送给逻辑设备(如逻辑防火墙等)，而不用管理员手动为逻辑设备分配业务配置文件，从而可以减轻管理员的工作量，并且可以避免业务配置文件的错误。
而且，在本申请实施例中，第一服务器接收到DHCP请求消息后，并不是直接将业务配置文件发送给逻辑设备，而是将业务配置文件的URL地址或第二服务器的IP地址发送给逻辑设备，其原因可以包括：第一服务器在接收到DHCP请求消息时，无法获知逻辑设备是否已经可以正常工作，若此时将业务配置文件发送给逻辑设备，假设逻辑设备当前还无法正常工作，就无法正确处理业务配置文件，导致无法利用业务配置文件进行配置。但是，若逻辑设备已经可以正常工作，则会发送下载请求消息，即逻辑设备可以通过这个下载请求消息请求下载业务配置文件，若此时将业务配置文件发送给逻辑设备，则逻辑设备可以正确处理业务配置文件。
以下结合具体的应用场景，对下发配置文件的方法进行详细说明。
应用场景1、参见图3A所示，为本申请实施例一应用场景的组网示意图，其中部署有第一服务器，第一服务器用于提供认证功能、DHCP功能、下载服务功能，为了方便描述，下载服务功能是以采用FTP(File Transfer Protocol，文件传输协议)的下载服务功能为例进行说明，当然，也可以是其它类型的下载服务功能，对此不做限制。认证功能可以是对用户进行身份认证的功能，比如基于用户名和密码的认证功能。基于认证功能，第一服务器可以对用户进行认证，在认证通过后，允许物理设备创建逻辑设备，并为逻辑设备生成业务配置文件。基于下载服务功能，第一服务器可以将业务配置文件发送给逻辑设备。基于DHCP功能，第一服务器可以将业务配置文件对应的地址信息发送给逻辑设备，逻辑设备利用该地址信息获取业务配置文件。
参见图3A所示，局域网1、局域网2和局域网3通过物理设备12连接到外网，物理设备12包括三个逻辑设备，分别为逻辑设备121、逻辑设备122、逻辑设备123。在初始状态下，物理设备12没有逻辑设备。应用本申请实施例提供的方法，可以在物理设备12上创建逻辑设备，并将业务配置文件下发给逻辑设备。
针对局域网1内的用户1，可以在第一服务器131进行注册，如注册用户名“AA”和密码“123456”，第一服务器131还可以预先配置用户授权等级1。针对局域网2的用户2，可以在第一服务器131进行注册，如注册用户名“BB”和密码“123123”，第一服务器131还可以预先配置用户授权等级2。针对局域网3的用户3，可以在第一服务器131进行注册，如注册用户名“CC”和密码“456456”，第一服务器131还可以预先配置用户授权等级3。其中，用户授权等级与用户购买服务有关，对于用户授权等级分配方式，对此不做限制。
基于上述信息，初始状态下，第一服务器131维护的关联表可以如上述表1所示。
在图3A所示应用场景中，由于每个逻辑设备的处理过程相同，为了简化描述，后续以局域网内的用户1创建逻辑设备(即图3A中的逻辑设备121)为例进行说明。本申请实施例中的下发业务配置文件方法可以包括以下步骤。
步骤a1、用户1通过主机111向第一服务器131发送认证请求消息，该认证 请求消息可以携带用户1的用户身份信息，用户1的用户身份信息包括：用户名“AA”和密码“123456”。
在本申请实施例中，用户1可以通过主机111向物理设备发送认证请求消息，该认证请求消息的目的地址为第一服务器131的IP地址，物理设备根据第一服务器131的IP地址，将该认证请求消息转发给第一服务器131。
步骤a2、第一服务器131在接收到该认证请求消息后，若表1中存在用户1的用户身份信息，则该用户身份信息通过认证，执行步骤a3；若表1中不存在用户1的用户身份信息，则该用户身份信息未通过认证，向主机111返回认证失败消息。对认证失败过程不再赘述，以通过认证为例进行说明。
步骤a3、第一服务器131分配一个设备标识(如abcd)，通过查询表1所示的关联表，获取与用户1的用户身份信息对应的用户授权等级1，并确定与该用户授权等级1对应的物理资源信息1。
其中，第一服务器131可以维护用户授权等级与物理资源信息的对应关系，如用户授权等级1与物理资源信息1的对应关系，用户授权等级2与物理资源信息2的对应关系，以此类推。因此，第一服务器131在得到用户授权等级1后，可以确定与该用户授权等级1对应的物理资源信息是物理资源信息1。
其中，物理资源信息是逻辑设备启动时的必备资源的信息，例如，物理资源信息可以包括但不限于以下之一或者任意组合：硬件资源(如磁盘等)、CPU、内存、最大吞吐量、会话数等。
步骤a4、第一服务器131向用户1的用户身份信息对应的物理设备12发送创建消息，该创建消息携带该设备标识abcd和该物理资源信息1。
其中，第一服务器131可以维护用户身份信息与物理设备的对应关系，例如，在关联表中维护用户身份信息与物理设备的对应关系，表1并未示出这一对应关系。基于此对应关系，第一服务器131可以向物理设备12发送创建消息。
步骤a5、物理设备12在接收到创建消息后，利用该设备标识abcd和该物理资源信息1创建逻辑设备(即图3A中所示的逻辑设备121)。
步骤a6、第一服务器131为逻辑设备121生成业务配置文件，并在表1中记录设备标识abcd与业务配置文件的URL地址的对应关系。
其中，步骤a6与步骤a4、步骤a5没有先后顺序关系，对此顺序不做限制。
其中，业务配置文件可以包括但不限于基础配置文件和/或定制配置文件。
基础配置文件与业务类型有关，相同业务类型的逻辑设备可以使用相同的基础配置文件，不同业务类型的逻辑设备可以使用不同的基础配置文件。第一服务器131可以存储各业务类型的基础配置文件，如业务类型A对应的基础配置文件A，业务类型B对应的基础配置文件B等，对于各基础配置文件的生成方式，在此不再赘述。其中，业务类型可以包括但不限于：IPS(Intrusion Prevention System，入侵防御系统)类型、AV(防毒墙)类型等，对此业务类型不做限制。
定制配置文件可以包括逻辑设备的个性配置，如ACL、限速阈值等，定制配置文件与用户的需求有关，可以根据用户的需求生成定制配置文件。
针对“第一服务器131为逻辑设备121生成业务配置文件”的过程，可以包括以下两种情况：
情况一、第一服务器131为逻辑设备121生成基础配置文件，具体的处理过程为：主机111向第一服务器131发送的认证请求消息中，还可以携带待创建的逻辑设备121的业务类型，如业务类型A。第一服务器131可以从认证请求消息中解析出该业务类型A，基于业务类型A与基础配置文件A的对应关系，可以为逻辑设备121生成与业务类型A对应的基础配置文件A。
情况二、第一服务器131为逻辑设备121生成基础配置文件和定制配置文件，具体的处理方式可以有以下两种：
方式一、第一服务器131从该认证请求消息中解析出业务类型，并生成与该业务类型对应的基础配置文件；从页面响应消息中解析出用户配置信息，并根据该用户配置信息生成定制配置文件。具体的处理过程为：第一服务器131为逻辑设备121生成与业务类型A对应的基础配置文件A，其实现过程参见上述情况一。第一服务器131向主机111发送页面消息，该页面消息可以携带配置参数。其中，该页面消息可以包括页面表单，该页面表单包括逻辑设备的设备标识、用于生成定制配置文件的配置参数，如接口名称、IP地址、接口VLAN、NAT(Network Address Translation，网络地址转换)参数、VPN(Virtual Private Network，虚拟专用网络)参数等，当然，还可以有其它类型的配置参 数，对此不做限制。
主机111在接收到页面消息后，可以将该页面表单显示给用户，基于页面表单显示的设备标识，用户可以获知将要为哪个逻辑设备输入用户配置信息，并在该页面表单输入与配置参数对应的用户配置信息。如接口名称为接口A、接口IP地址为200.0.0.9、接口VLAN是VLAN101、NAT参数是将IP地址A转换为IP地址B、VPN参数是监听IP网段R和监听端口X等。此外，用户在该页面表单输入的用户配置信息还可以包括以下内容：禁止访问的网址(例如www.aaa.com)、用于进行限速处理的带宽限制、禁止访问的IP地址等。当然，上述用户配置信息只是一个示例，对此用户配置信息的内容不做限制。
主机111获取用户配置信息和页面表单包括的设备标识，并向第一服务器131发送页面响应消息，该页面响应消息可以携带用户配置信息、设备标识。第一服务器131在接收到该页面响应消息后，从该页面响应消息中解析出用户配置信息和设备标识。
第一服务器131可以根据该用户配置信息为逻辑设备生成定制配置文件A。例如，针对“禁止访问的网址(例如www.aaa.com)”这个用户配置信息，定制配置文件A中可以包括一条deny(拒绝)的ACL(Access Control List，访问控制列表)，如deny 220.0.0.5(即www.aaa.com对应的IP地址)。针对“用于进行限速处理的带宽限制”这个用户配置信息，定制配置文件A中可以包括限速命令行，如CAR(Committed Access Rate，承诺访问数率)5000kbps等。针对“禁止访问的IP地址”这个用户配置信息，定制配置文件A中可以包括禁止该IP地址访问网络的ACL。当然，上述过程只是生成定制配置文件A的示例，对此不做限制。
方式二、第一服务器131可以通过发送页面消息，获取业务类型和用户配置信息，从而生成基础配置文件和定制配置文件，具体的处理过程为：第一服务器131为逻辑设备121生成与业务类型A对应的基础配置文件A，其实现过程参见上述情况一，不同之处在于：第一服务器131不是从认证请求消息中解析出业务类型，而是从页面响应消息中解析出业务类型。第一服务器131为逻辑设备121生成定制配置文件A，其实现过程参见方式一。
其中，第一服务器131为逻辑设备生成基础配置文件A后，还可以在关联 表中记录逻辑设备121的设备标识abcd与基础配置文件A的URL地址的对应关系。第一服务器131为逻辑设备生成定制配置文件A后，还可以在关联表中记录逻辑设备121的设备标识abcd与定制配置文件A的URL地址的对应关系。
由于认证请求消息携带用户身份信息，而页面响应消息携带设备标识，因此，可以根据用户身份信息或者设备标识，将基础配置文件的URL地址、定制配置文件的URL地址记录到关联表中。此外，还可以将基础配置文件的名称、定制配置文件的名称记录到关联表中。参见表2所示，为关联表的示例。
其中，在将基础配置文件A存储到存储位置A时，存储位置A对应的URL地址也就是基础配置文件A的URL地址。在将定制配置文件A存储到存储位置B时，存储位置B对应的URL地址也就是基础配置文件B的URL地址。
表2
Figure PCTCN2018102196-appb-000002
步骤a7、物理设备12创建逻辑设备121后，逻辑设备121可以采用广播方式发送DHCP请求消息，该DHCP请求消息携带设备标识abcd，例如，DHCP请求消息的第一选项字段(如Option 82字段等)可以携带该设备标识abcd。
步骤a8、第一服务器131在接收到该DHCP请求消息之后，可以为逻辑设 备121分配一个IP地址100.100.0.0，并通过该设备标识abcd查询表2所示的关联表，得到与该设备标识abcd对应的URL地址A和URL地址B。
步骤a9、第一服务器131向逻辑设备121发送DHCP响应消息，DHCP响应消息携带IP地址100.100.0.0、URL地址A和URL地址B。示例性的，可以通过DHCP响应消息的第二选项字段(如Option100字段)携带URL地址A和URL地址B。
步骤a10、逻辑设备121在接收到DHCP响应消息后，从DHCP响应消息中解析出URL地址A和URL地址B，并向第一服务器131发送携带URL地址A的FTP下载请求，向第一服务器131发送携带URL地址B的FTP下载请求。
步骤a11、第一服务器131在接收到携带URL地址A的FTP下载请求后，可以从与URL地址A对应的存储位置A获取到基础配置文件A，并向逻辑设备121发送携带基础配置文件A的FTP响应消息。第一服务器131在接收到携带URL地址B的FTP下载请求后，可以从与URL地址B对应的存储位置B获取到定制配置文件A，并向逻辑设备121发送携带定制配置文件A的FTP响应消息。
步骤a12、逻辑设备121在接收到携带基础配置文件A的FTP响应消息后，从该FTP响应消息中解析出基础配置文件A。逻辑设备121在接收到携带定制配置文件A的FTP响应消息后，从该FTP响应消息中解析出定制配置文件A。
应用场景2、参见图3B所示，为本申请实施例另一应用场景的组网示意图，其中部署有第一服务器和第二服务器，该第一服务器用于提供DHCP功能，并且，第一服务器上可以预先记录有第二服务器的IP地址，第一服务器还可以将第二服务器配置为用于为逻辑设备提供业务配置文件的服务器。该第二服务器用于提供认证功能、下载服务功能(如FTP服务功能)。基于认证功能，第二服务器可以对用户进行认证，在认证通过后，允许物理设备创建逻辑设备，并为逻辑设备生成业务配置文件。基于下载服务功能，第二服务器可以将业务配置文件发送给逻辑设备。基于DHCP功能，第一服务器可以将业务配置文件对应的地址信息发送给逻辑设备，逻辑设备利用该地址信息获取业务配置文件。
图3B与图3A相比，多了第二服务器132，各用户在第二服务器132进行注册，且第二服务器132维护表1所示的关联表，对此不再赘述。
在上述应用场景下，本申请实施例的下发业务配置文件的方法可以包括以下步骤：
步骤b1-步骤b7，处理流程参见应用场景1的步骤a1-步骤a7，其区别在于：在应用场景1中，步骤a1-步骤a7的相关操作是第一服务器131执行，在应用场景2中，步骤b1-步骤b7的相关操作是第二服务器132执行，在此不再赘述。
步骤b8、第二服务器132在接收到DHCP请求消息后，由于不具有DHCP功能，因此丢弃DHCP请求消息。第一服务器131在收到DHCP请求消息后，由于具有DHCP功能，因此为逻辑设备121分配一个IP地址100.100.0.0，并获取第二服务器132的IP地址。
步骤b9、第一服务器131向逻辑设备121发送DHCP响应消息，该DHCP响应消息携带IP地址100.100.0.0、第二服务器132的IP地址。例如，通过DHCP响应消息的第二选项字段(如Option100字段)携带第二服务器132的IP地址，通过以yiaddr字段携带该IP地址100.100.0.0。
步骤b10、逻辑设备121在接收到DHCP响应消息之后，从该DHCP响应消息中解析出第二服务器132的IP地址，并利用所述第二服务器132的IP地址，向第二服务器132发送用于请求URL地址的请求消息，该请求消息携带该设备标识abcd。
步骤b11、第二服务器132通过该设备标识abcd查询表2所示的关联表，得到与该设备标识abcd对应的URL地址A和URL地址B。
步骤b12、第二服务器132向逻辑设备121发送响应消息，该响应消息携带URL地址A和URL地址B。
步骤b13、逻辑设备121向第二服务器132发送携带URL地址A的FTP下载请求，并向第二服务器132发送携带URL地址B的FTP下载请求。
步骤b14、第二服务器132在接收到携带URL地址A的FTP下载请求后，可以从与URL地址A对应的存储位置A获取到基础配置文件A，并向逻辑设备121发送携带基础配置文件A的FTP响应消息。第二服务器132在接收到携带URL地址B的FTP下载请求后，可以从与URL地址B对应的存储位置B获取到定制配置文件A，并向逻辑设备121发送携带定制配置文件A的FTP响应消息。
步骤b15、逻辑设备121在接收到携带基础配置文件A的FTP响应消息后，从该FTP响应消息中解析出基础配置文件A。逻辑设备121在接收到携带定制配置文件A的FTP响应消息后，从该FTP响应消息中解析出定制配置文件A。
在另一本申请实施例中，在步骤b10中，逻辑设备121向第二服务器132发送FTP下载请求，该FTP下载请求携带该设备标识abcd。第二服务器132通过该设备标识abcd查询表2所示的关联表，得到URL地址A和URL地址B，从URL地址A对应的存储位置A获取到基础配置文件A，并向逻辑设备121发送携带基础配置文件A的FTP响应消息，从URL地址B对应的存储位置B获取到定制配置文件A，并向逻辑设备121发送携带定制配置文件A的FTP响应消息。这样，逻辑设备121也可以获取到基础配置文件A和定制配置文件A。
本申请实施例中，针对上述应用场景，还可以修改逻辑设备的基础配置文件和/或定制配置文件，主机可以向第一服务器131/第二服务器132(应用场景1中是第一服务器131，应用场景2中是第二服务器132)发送配置文件更改消息。
本申请实施例中，若修改逻辑设备的基础配置文件，则该配置文件更改消息可以携带用户身份信息、修改后的业务类型。若修改逻辑设备的定制配置文件，则该配置文件更改消息可以携带用户身份信息、修改后的用户配置信息。若修改逻辑设备的基础配置文件和定制配置文件，则该配置文件更改消息可以携带用户身份信息、修改后的业务类型、修改后的用户配置信息。
基于此，第一服务器131/第二服务器132还可以接收到主机发送的配置文件更改消息。若该配置文件更改消息携带修改后的业务类型，则为逻辑设备生成与修改后的业务类型对应的新基础配置文件；和/或，若该配置文件更改消息携带修改后的用户配置信息，则根据修改后的用户配置信息为逻辑设备生成新定制配置文件。然后，可以在关联表中记录逻辑设备的设备标识与新基础配置文件的URL地址、和/或新定制配置文件的URL地址的对应关系。
例如，当用户变更逻辑设备121的业务类型时，如将业务类型A变更为业务类型B，触发主机111向第一服务器131/第二服务器132发送配置文件更改消息，该配置文件更改消息可以携带用户身份信息、业务类型B，这样，第一服务器131/第二服务器132可以为逻辑设备121生成基础配置文件B，在关联表中 记录逻辑设备121的设备标识(如abcd)与基础配置文件B的URL地址的对应关系。其中，第一服务器131/第二服务器132可以基于配置文件更改消息携带的用户身份信息确定设备标识(如abcd)。
又例如，当用户变更逻辑设备121的定制配置文件A时，触发主机111重新向用户显示页面表单，用户可以在该页面表单输入更改后的用户配置信息。例如，可以将接口VLAN从VLAN101修改为VLAN102，并可以在页面表单中删除NAT参数等，页面表单的其它用户配置信息不变。
然后，触发主机111向第一服务器131/第二服务器132发送配置文件更改消息，该配置文件更改消息可以携带用户身份信息、变更后的用户配置信息，第一服务器131/第二服务器132可以根据变更后的用户配置信息重新生成定制配置文件，在关联表中记录逻辑设备121的设备标识与新的定制配置文件的对应关系。
进一步的，在应用场景1中，重新执行步骤a7-步骤a12，在应用场景2中，重新执行步骤b7-步骤b15，可以将新基础配置文件和/或新定制配置文件发送给逻辑设备121，逻辑设备121更新自身的基础配置文件和/或定制配置文件。
基于上述技术方案，当更新逻辑设备的基础配置文件和/或定制配置文件时，可以在第一服务器131/第二服务器132生成新基础配置文件和/或定制配置文件，然后可以将逻辑设备121的基础配置文件和/或定制配置文件更新为新基础配置文件和/或定制配置文件，实现更加自动化、智能化，提高用户的业务体验。而且，在为逻辑设备生成新基础配置文件和/或定制配置文件后，第一服务器131/第二服务器132可以不删除已有的基础配置文件和/或定制配置文件，即存储逻辑设备121的多个基础配置文件和/或定制配置文件。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。
本申请实施例中，对于方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请实施例并不受所描述的动作顺序的限制，因为依据本申请实施例，某些步骤可以采用其他顺序 或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作并不一定是本申请实施例所必须的。
参照图4，图4示出了本申请实施例提供的一种下发业务配置文件的装置的结构框图。
本申请实施例的下发业务配置文件的装置可以应用于第一服务器，具体可以包括接收模块401、确定模块402、发送模块403。各模块的介绍如下所示。
接收模块401，用于接收逻辑设备发送的DHCP请求消息，该逻辑设备在物理设备上创建。
确定模块402，用于确定与所述逻辑设备的业务配置文件对应的地址信息。
发送模块403，用于向所述逻辑设备发送携带所述地址信息的DHCP响应消息，以使所述逻辑设备根据所述DHCP响应消息中的地址信息获取业务配置文件。
在本申请的一个可选实施例中，所述确定模块402，具体用于获取第二服务器的IP地址，所述第二服务器为所述逻辑设备提供业务配置文件；将所述第二服务器的IP地址确定为与所述逻辑设备的业务配置文件对应的地址信息。
在本申请的一个可选实施例中，所述确定模块402，具体从所述DHCP请求消息中解析出所述逻辑设备的设备标识，通过所述设备标识查询关联表，得到与所述设备标识对应的业务配置文件的URL地址，并将所述URL地址确定为与所述逻辑设备的业务配置文件对应的地址信息；其中，所述关联表用于记录逻辑设备的设备标识、业务配置文件的URL地址的对应关系。
参照图5，图5示出了本申请实施例提供的另一种下发业务配置文件的装置的结构框图。
在本申请的一个可选实施例中，所述下发业务配置文件的装置还包括：生成模块404。
所述接收模块401，还用于接收主机发送的认证请求消息，所述认证请求消息携带用户身份信息。
所述确定模块402，还用于若所述用户身份信息通过认证，则为待创建的 逻辑设备分配设备标识，并获取与所述用户身份信息对应的用户授权等级，确定与所述用户授权等级对应的物理资源信息。
所述发送模块403，还用于向所述用户身份信息对应的所述物理设备发送创建消息，所述创建消息携带所述设备标识和所述物理资源信息，以使所述物理设备利用所述设备标识和所述物理资源信息创建所述逻辑设备。
所述生成模块404，用于为所述逻辑设备生成业务配置文件，并确定与所述业务配置文件的存储位置对应的URL地址，在关联表中记录所述设备标识与所述业务配置文件的URL地址的对应关系。
在本申请的一个可选实施例中，当业务配置文件包括基础配置文件时，所述生成模块404，具体用于从所述认证请求消息中解析出业务类型，为逻辑设备生成与所述业务类型对应的基础配置文件。
从所述认证请求消息中解析出业务类型，为所述逻辑设备生成与所述业务类型对应的基础配置文件，向主机发送携带配置参数的页面消息，以使所述主机获取与所述配置参数对应的用户配置信息；接收主机发送的页面响应消息，所述页面响应消息携带所述用户配置信息，根据所述用户配置信息为所述逻辑设备生成定制配置文件；或者，向主机发送携带配置参数的页面消息，以使所述主机获取业务类型、与所述配置参数对应的用户配置信息；接收所述主机发送的页面响应消息，所述页面响应消息携带所述业务类型和所述用户配置信息；为所述逻辑设备生成与所述业务类型对应的基础配置文件，根据所述用户配置信息为所述逻辑设备生成定制配置文件。
参照图6，图6示出了本申请实施例提供的另一种下发业务配置文件的装置的结构框图。
在本申请的一个可选实施例中，所述下发业务配置文件的装置还包括：获取模块405。
所述接收模块401，还用于接收所述逻辑设备发送的下载请求消息，所述下载请求消息携带与所述设备标识对应的业务配置文件的URL地址。
所述获取模块405，用于从所述URL地址对应的存储位置获取与所述逻辑设备对应的业务配置文件，并向所述逻辑设备发送下载响应消息，所述下载 响应消息携带所述业务配置文件。
在本申请的一个可选实施例中，所述接收模块401，还用于接收所述主机发送的配置文件更改消息。
所述生成模块404，还用于若所述配置文件更改消息携带修改后的业务类型，则为所述逻辑设备生成与所述修改后的业务类型对应的新基础配置文件；和/或，若所述配置文件更改消息携带修改后的用户配置信息，则根据所述修改后的用户配置信息为所述逻辑设备生成新定制配置文件；
在所述关联表中记录所述逻辑设备的设备标识与所述新基础配置文件的URL地址、和/或所述新定制配置文件的URL地址的对应关系。
应用本申请实施例，可以自动将业务配置文件发送给逻辑设备(如逻辑防火墙等)，而不用管理员手动为逻辑设备分配业务配置文件，从而可以减轻管理员的工作量，并且可以避免业务配置文件的错误。
与上述下发业务配置文件的方法实施例对应，本申请实施例还提供了一种服务器。该服务器可以作为第一服务器，参照图7，图7示出了本申请实施例提供的一种服务器的结构框图。该服务器包括：处理器701和机器可读存储介质702，机器可读存储介质702存储有能够被处理器701执行的机器可执行指令，机器可执行指令可以包括：第一接收指令712、第一确定指令722、第一发送指令732.
所述处理器701被所述第一接收指令712促使实现：接收逻辑设备发送的DHCP请求消息，该逻辑设备在物理设备上创建。
所述处理器701被所述第一确定指令722促使实现：确定与所述逻辑设备的业务配置文件对应的地址信息。
所述处理器701被所述第一发送指令732促使实现：向所述逻辑设备发送携带所述地址信息的DHCP响应消息，以使所述逻辑设备根据所述DHCP响应消息中的地址信息获取所述逻辑设备的业务配置文件。
在本申请的一个可选实施例中，所述处理器701被所述第一确定指令722促使具体实现：
获取第二服务器的IP地址，所述第二服务器为所述逻辑设备提供业务配置文件；
将所述第二服务器的IP地址确定为与所述逻辑设备的业务配置文件对应的地址信息。
在本申请的一个可选实施例中，所述DHCP请求消息中携带有所述逻辑设备的设备标识，所述处理器701被所述第一确定指令722促使具体实现：
从所述DHCP请求消息中解析出所述逻辑设备的设备标识，通过所述设备标识查询关联表，得到与所述设备标识对应的业务配置文件的URL地址，并将所述URL地址确定为与所述逻辑设备的业务配置文件对应的地址信息；其中，所述关联表用于记录逻辑设备的设备标识、业务配置文件的URL地址的对应关系。
在本申请的一个可选实施例中，所述机器可执行指令还包括：第二接收指令、第二确定指令、第二发送指令、第一生成指令。
所述处理器701被所述第二接收指令促使实现：接收主机发送的认证请求消息，所述认证请求消息携带用户身份信息。
所述处理器701被所述第二确定指令促使实现：若所述用户身份信息通过认证，则为待创建的逻辑设备分配设备标识，并获取与所述用户身份信息对应的用户授权等级，确定与所述用户授权等级对应的物理资源信息。
所述处理器701被所述第二发送指令促使实现：向所述用户身份信息对应的所述物理设备发送创建消息，所述创建消息携带所述设备标识和所述物理资源信息，以使所述物理设备利用所述设备标识和所述物理资源信息创建所述逻辑设备。
所述处理器701被所述第一生成指令促使实现：为所述逻辑设备生成业务配置文件，并确定与所述业务配置文件的存储位置对应的URL地址，在关联表中记录所述设备标识与所述业务配置文件的URL地址的对应关系。
在本申请的一个可选实施例中，当所述业务配置文件包括基础配置文件时，所述处理器701被所述第一生成指令促使具体实现：
从所述认证请求消息中解析出业务类型，并为所述逻辑设备生成与所述业务类型对应的基础配置文件；
当所述业务配置文件包括基础配置文件和定制配置文件时，所述处理器701被所述第一生成指令促使具体实现：
从所述认证请求消息中解析出业务类型，为所述逻辑设备生成与所述业 务类型对应的基础配置文件，向主机发送携带配置参数的页面消息，以使所述主机获取与所述配置参数对应的用户配置信息；接收主机发送的页面响应消息，所述页面响应消息携带所述用户配置信息，根据所述用户配置信息为所述逻辑设备生成定制配置文件；
或者，向主机发送携带配置参数的页面消息，以使所述主机获取业务类型、与所述配置参数对应的用户配置信息；接收所述主机发送的页面响应消息，所述页面响应消息携带所述业务类型和所述用户配置信息；为所述逻辑设备生成与所述业务类型对应的基础配置文件，根据所述用户配置信息为所述逻辑设备生成定制配置文件。
在本申请的一个可选实施例中，所述机器可执行指令还包括：第三接收指令、获取指令。
所述处理器701被所述第三接收指令促使实现：接收所述逻辑设备发送的下载请求消息，所述下载请求消息携带与所述设备标识对应的业务配置文件的URL地址。
所述处理器701被所述获取指令促使实现：从所述URL地址对应的存储位置获取与所述逻辑设备对应的业务配置文件，并向所述逻辑设备发送下载响应消息，所述下载响应消息携带所述业务配置文件。
在本申请的一个可选实施例中，所述机器可执行指令还包括：第四接收指令、第二生成指令。
所述处理器701被所述第四接收指令促使实现：接收所述主机发送的配置文件更改消息。
所述处理器701被所述第二生成指令促使实现若所述配置文件更改消息携带修改后的业务类型，则为所述逻辑设备生成与所述修改后的业务类型对应的新基础配置文件；和/或，若所述配置文件更改消息携带修改后的用户配置信息，则根据所述修改后的用户配置信息为所述逻辑设备生成新定制配置文件；
在所述关联表中记录所述逻辑设备的设备标识与所述新基础配置文件的URL地址、和/或所述新定制配置文件的URL地址的对应关系。
如图7所示，服务器还可以包括通信总线703，处理器701、机器可读存储介质702通过通信总线703完成相互间的通信，可以是外设部件互连标准 (Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。该通信总线703可以分为地址总线、数据总线、控制总线等。
机器可读存储介质702可以包括随机存取存储器(Random Access Memory，RAM)，也可以包括非易失性存储器(Non-Volatile Memory，NVM)，例如至少一个磁盘存储器。另外，机器可读存储介质702还可以是至少一个位于远离前述处理器的存储装置。
处理器701可以是通用处理器，包括中央处理器(Central Processing Unit，CPU)、网络处理器(Network Processor，NP)等；还可以是数字信号处理器(Digital Signal Processing，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
与上述下发业务配置文件的方法实施例对应，本申请实施例还提供了一种机器可读存储介质。该机器可读存储介质可以位于服务器上，机器可读存储介质存储有机器可执行指令，机器可执行指令包括：第一接收指令、第一确定指令、第一发送指令。
在被处理器调用和执行时，所述第一接收指令促使所述处理器实现：接收逻辑设备发送的DHCP请求消息，该逻辑设备在物理设备上创建。
在被处理器调用和执行时，所述第一确定指令促使所述处理器实现：确定与所述逻辑设备的业务配置文件对应的地址信息。
在被处理器调用和执行时，所述第一发送指令促使所述处理器实现：向所述逻辑设备发送携带所述地址信息的DHCP响应消息，以使所述逻辑设备根据所述DHCP响应消息中的地址信息获取所述逻辑设备的业务配置文件。
在本申请的一个可选实施例中，所述处理器被所述第一确定指令促使具体实现：
获取第二服务器的IP地址，所述第二服务器为所述逻辑设备提供业务配置文件；
将所述第二服务器的IP地址确定为与所述逻辑设备的业务配置文件对应的地址信息。
在本申请的一个可选实施例中，所述DHCP请求消息中携带有所述逻辑设备的设备标识，所述处理器被所述第一确定指令促使具体实现：
从所述DHCP请求消息中解析出所述逻辑设备的设备标识，通过所述设备标识查询关联表，得到与所述设备标识对应的业务配置文件的URL地址，并将所述URL地址确定为与所述逻辑设备的业务配置文件对应的地址信息；其中，所述关联表用于记录逻辑设备的设备标识、业务配置文件的URL地址的对应关系。
在本申请的一个可选实施例中，所述机器可执行指令还包括：第二接收指令、第二确定指令、第二发送指令、第一生成指令。
所述处理器被所述第二接收指令促使实现：接收主机发送的认证请求消息，所述认证请求消息携带用户身份信息。
所述处理器被所述第二确定指令促使实现：若所述用户身份信息通过认证，则为待创建的逻辑设备分配设备标识，并获取与所述用户身份信息对应的用户授权等级，确定与所述用户授权等级对应的物理资源信息。
所述处理器被所述第二发送指令促使实现：向所述用户身份信息对应的所述物理设备发送创建消息，所述创建消息携带所述设备标识和所述物理资源信息，以使所述物理设备利用所述设备标识和所述物理资源信息创建所述逻辑设备。
所述处理器被所述第一生成指令促使实现：为所述逻辑设备生成业务配置文件，并确定与所述业务配置文件的存储位置对应的URL地址，在关联表中记录所述设备标识与所述业务配置文件的URL地址的对应关系。
在本申请的一个可选实施例中，当所述业务配置文件包括基础配置文件时，所述处理器被所述第一生成指令促使具体实现：
从所述认证请求消息中解析出业务类型，并为所述逻辑设备生成与所述业务类型对应的基础配置文件；
当所述业务配置文件包括基础配置文件和定制配置文件时，所述处理器被所述第一生成指令促使具体实现：
从所述认证请求消息中解析出业务类型，为所述逻辑设备生成与所述业务类型对应的基础配置文件，向主机发送携带配置参数的页面消息，以使所述主机获取与所述配置参数对应的用户配置信息；接收主机发送的页面响应 消息，所述页面响应消息携带所述用户配置信息，根据所述用户配置信息为所述逻辑设备生成定制配置文件；
或者，向主机发送携带配置参数的页面消息，以使所述主机获取业务类型、与所述配置参数对应的用户配置信息；接收所述主机发送的页面响应消息，所述页面响应消息携带所述业务类型和所述用户配置信息；为所述逻辑设备生成与所述业务类型对应的基础配置文件，根据所述用户配置信息为所述逻辑设备生成定制配置文件。
在本申请的一个可选实施例中，所述机器可执行指令还包括：第三接收指令、获取指令；
所述处理器被所述第三接收指令促使实现：接收所述逻辑设备发送的下载请求消息，所述下载请求消息携带与所述设备标识对应的业务配置文件的URL地址；
所述处理器被所述获取指令促使实现：从所述URL地址对应的存储位置获取与所述逻辑设备对应的业务配置文件，并向所述逻辑设备发送下载响应消息，所述下载响应消息携带所述业务配置文件。
在本申请的一个可选实施例中，所述机器可执行指令还包括：第四接收指令、第二生成指令；
所述处理器被所述第四接收指令促使实现：接收所述主机发送的配置文件更改消息；
所述处理器被所述第二生成指令促使实现：若所述配置文件更改消息携带修改后的业务类型，则为所述逻辑设备生成与所述修改后的业务类型对应的新基础配置文件；和/或，若所述配置文件更改消息携带修改后的用户配置信息，则根据所述修改后的用户配置信息为所述逻辑设备生成新定制配置文件；
在所述关联表中记录所述逻辑设备的设备标识与所述新基础配置文件的URL地址、和/或所述新定制配置文件的URL地址的对应关系。
应用本申请实施例，可以自动将业务配置文件发送给逻辑设备(如逻辑防火墙等)，而不用管理员手动为逻辑设备分配业务配置文件，从而可以减轻管理员的工作量，并且可以避免业务配置文件的错误。
对于下发业务配置文件的装置、服务器、机器可读存储介质实施例而言， 由于其与下发业务配置文件的方法实施例基本相似，所以描述的比较简单，相关之处参见下发业务配置文件的方法实施例的部分说明即可。
本说明书中的各个实施例均采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似的部分互相参见即可。
本领域内的技术人员应明白，本申请实施例的实施例可提供为方法、装置、或计算机程序产品。因此，本申请实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请实施例是参照根据本申请实施例的方法、终端设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理终端设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理终端设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理终端设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理终端设备上，使得在计算机或其他可编程终端设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程终端设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请实施例的优选实施例，但本领域内的技术人员一旦 得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请实施例范围的所有变更和修改。
最后，还需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者终端设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者终端设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者终端设备中还存在另外的相同要素。

Claims (15)

  1. 一种下发业务配置文件的方法，应用于第一服务器，包括：
    接收逻辑设备发送的DHCP请求消息，该逻辑设备在物理设备上创建；
    确定与所述逻辑设备的业务配置文件对应的地址信息；
    向所述逻辑设备发送携带所述地址信息的DHCP响应消息，以使所述逻辑设备根据所述DHCP响应消息中的地址信息获取所述逻辑设备的业务配置文件。
  2. 根据权利要求1所述的方法，所述确定与所述逻辑设备的业务配置文件对应的地址信息的过程，包括：
    获取第二服务器的IP地址，所述第二服务器为所述逻辑设备提供业务配置文件；
    将所述第二服务器的IP地址确定为与所述逻辑设备的业务配置文件对应的地址信息。
  3. 根据权利要求1所述的方法，所述DHCP请求消息携带所述逻辑设备的设备标识，所述确定与所述逻辑设备的业务配置文件对应的地址信息的过程，包括：
    从所述DHCP请求消息中解析出所述逻辑设备的设备标识，通过所述设备标识查询关联表，得到与所述设备标识对应的业务配置文件的URL地址，并将所述URL地址确定为与所述逻辑设备的业务配置文件对应的地址信息；其中，所述关联表用于记录逻辑设备的设备标识、业务配置文件的URL地址的对应关系。
  4. 根据权利要求3所述的方法，所述接收逻辑设备发送的DHCP请求消息之前，所述方法还包括：
    接收主机发送的认证请求消息，所述认证请求消息携带用户身份信息；
    若所述用户身份信息通过认证，则为待创建的逻辑设备分配设备标识，并获取与所述用户身份信息对应的用户授权等级，确定与所述用户授权等级对应的物理资源信息；
    向所述用户身份信息对应的所述物理设备发送创建消息，所述创建消息携带所述设备标识和所述物理资源信息，以使所述物理设备利用所述设备标识和所述物理资源信息创建所述逻辑设备；
    为所述逻辑设备生成业务配置文件，并确定与所述业务配置文件的存储 位置对应的URL地址，在关联表中记录所述设备标识与所述业务配置文件的URL地址的对应关系。
  5. 根据权利要求4所述的方法，
    当所述业务配置文件包括基础配置文件时，所述为所述逻辑设备生成业务配置文件的过程，包括：
    从所述认证请求消息中解析出业务类型，并为所述逻辑设备生成与所述业务类型对应的基础配置文件；
    当所述业务配置文件包括基础配置文件和定制配置文件时，所述为所述逻辑设备生成业务配置文件的过程，包括：
    从所述认证请求消息中解析出业务类型，为所述逻辑设备生成与所述业务类型对应的基础配置文件，向主机发送携带配置参数的页面消息，以使所述主机获取与所述配置参数对应的用户配置信息；接收主机发送的页面响应消息，所述页面响应消息携带所述用户配置信息，根据所述用户配置信息为所述逻辑设备生成定制配置文件；
    或者，向主机发送携带配置参数的页面消息，以使所述主机获取业务类型、与所述配置参数对应的用户配置信息；接收所述主机发送的页面响应消息，所述页面响应消息携带所述业务类型和所述用户配置信息；为所述逻辑设备生成与所述业务类型对应的基础配置文件，根据所述用户配置信息为所述逻辑设备生成定制配置文件。
  6. 根据权利要求3所述的方法，所述向所述逻辑设备发送携带所述地址信息的DHCP响应消息之后，所述方法还包括：
    接收所述逻辑设备发送的下载请求消息，所述下载请求消息携带与所述设备标识对应的业务配置文件的URL地址；
    从与所述URL地址对应的存储位置获取与所述逻辑设备对应的业务配置文件，并向所述逻辑设备发送下载响应消息，所述下载响应消息携带所述业务配置文件。
  7. 根据权利要求5所述的方法，所述为所述逻辑设备生成业务配置文件之后，所述方法还包括：
    接收所述主机发送的配置文件更改消息；
    若所述配置文件更改消息携带修改后的业务类型，则为所述逻辑设备生 成与所述修改后的业务类型对应的新基础配置文件；和/或，若所述配置文件更改消息携带修改后的用户配置信息，则根据所述修改后的用户配置信息为所述逻辑设备生成新定制配置文件；
    在所述关联表中记录所述逻辑设备的设备标识与所述新基础配置文件的URL地址、和/或所述新定制配置文件的URL地址的对应关系。
  8. 一种服务器，作为第一服务器，所述第一服务器包括：处理器和机器可读存储介质，所述机器可读存储介质存储有能够被所述处理器执行的机器可执行指令，所述机器可执行指令包括：第一接收指令、第一确定指令、第一发送指令；
    所述处理器被所述第一接收指令促使实现：接收逻辑设备发送的DHCP请求消息，该逻辑设备在物理设备上创建；
    所述处理器被所述第一确定指令促使实现：确定与所述逻辑设备的业务配置文件对应的地址信息；
    所述处理器被所述第一发送指令促使实现：向所述逻辑设备发送携带所述地址信息的DHCP响应消息，以使所述逻辑设备根据所述DHCP响应消息中的地址信息获取所述逻辑设备的业务配置文件。
  9. 根据权利要求8所述的服务器，所述处理器被所述第一确定指令促使具体实现：
    获取第二服务器的IP地址，所述第二服务器为所述逻辑设备提供业务配置文件；
    将所述第二服务器的IP地址确定为与所述逻辑设备的业务配置文件对应的地址信息。
  10. 根据权利要求8所述的服务器，所述DHCP请求消息中携带有所述逻辑设备的设备标识，所述处理器被所述第一确定指令促使具体实现：
    从所述DHCP请求消息中解析出所述逻辑设备的设备标识，通过所述设备标识查询关联表，得到与所述设备标识对应的业务配置文件的URL地址，并将所述URL地址确定为与所述逻辑设备的业务配置文件对应的地址信息；其中，所述关联表用于记录逻辑设备的设备标识、业务配置文件的URL地址的对应关系。
  11. 根据权利要求10所述的服务器，所述机器可执行指令还包括：第二 接收指令、第二确定指令、第二发送指令、第一生成指令；
    所述处理器被所述第二接收指令促使实现：接收主机发送的认证请求消息，所述认证请求消息携带用户身份信息；
    所述处理器被所述第二确定指令促使实现：若所述用户身份信息通过认证，则为待创建的逻辑设备分配设备标识，并获取与所述用户身份信息对应的用户授权等级，确定与所述用户授权等级对应的物理资源信息；
    所述处理器被所述第二发送指令促使实现：向所述用户身份信息对应的所述物理设备发送创建消息，所述创建消息携带所述设备标识和所述物理资源信息，以使所述物理设备利用所述设备标识和所述物理资源信息创建所述逻辑设备；
    所述处理器被所述第一生成指令促使实现：为所述逻辑设备生成业务配置文件，并确定与所述业务配置文件的存储位置对应的URL地址，在关联表中记录所述设备标识与所述业务配置文件的URL地址的对应关系。
  12. 根据权利要求11所述的服务器，当所述业务配置文件包括基础配置文件时，所述处理器被所述第一生成指令促使具体实现：
    从所述认证请求消息中解析出业务类型，并为所述逻辑设备生成与所述业务类型对应的基础配置文件；
    当所述业务配置文件包括基础配置文件和定制配置文件时，所述处理器被所述第一生成指令促使具体实现：
    从所述认证请求消息中解析出业务类型，为所述逻辑设备生成与所述业务类型对应的基础配置文件，向主机发送携带配置参数的页面消息，以使所述主机获取与所述配置参数对应的用户配置信息；接收主机发送的页面响应消息，所述页面响应消息携带所述用户配置信息，根据所述用户配置信息为所述逻辑设备生成定制配置文件；
    或者，向主机发送携带配置参数的页面消息，以使所述主机获取业务类型、与所述配置参数对应的用户配置信息；接收所述主机发送的页面响应消息，所述页面响应消息携带所述业务类型和所述用户配置信息；为所述逻辑设备生成与所述业务类型对应的基础配置文件，根据所述用户配置信息为所述逻辑设备生成定制配置文件。
  13. 根据权利要求10所述的服务器，所述机器可执行指令还包括：第三 接收指令、获取指令；
    所述处理器被所述第三接收指令促使实现：接收所述逻辑设备发送的下载请求消息，所述下载请求消息携带与所述设备标识对应的业务配置文件的URL地址；
    所述处理器被所述获取指令促使实现：从所述URL地址对应的存储位置获取与所述逻辑设备对应的业务配置文件，并向所述逻辑设备发送下载响应消息，所述下载响应消息携带所述业务配置文件。
  14. 根据权利要求12所述的服务器，所述机器可执行指令还包括：第四接收指令、第二生成指令；
    所述处理器被所述第四接收指令促使实现：接收所述主机发送的配置文件更改消息；
    所述处理器被所述第二生成指令促使实现：若所述配置文件更改消息携带修改后的业务类型，则为所述逻辑设备生成与所述修改后的业务类型对应的新基础配置文件；和/或，若所述配置文件更改消息携带修改后的用户配置信息，则根据所述修改后的用户配置信息为所述逻辑设备生成新定制配置文件；
    在所述关联表中记录所述逻辑设备的设备标识与所述新基础配置文件的URL地址、和/或所述新定制配置文件的URL地址的对应关系。
  15. 一种机器可读存储介质，所述机器可读存储介质存储有机器可执行指令，所述机器可执行指令包括：第一接收指令、第一确定指令、第一发送指令；
    在被处理器调用和执行时，所述第一接收指令促使所述处理器实现：接收逻辑设备发送的DHCP请求消息，该逻辑设备在物理设备上创建；
    在被处理器调用和执行时，所述第一确定指令促使所述处理器实现：确定与所述逻辑设备的业务配置文件对应的地址信息；
    在被处理器调用和执行时，所述第一发送指令促使所述处理器实现：向所述逻辑设备发送携带所述地址信息的DHCP响应消息，以使所述逻辑设备根据所述DHCP响应消息中的地址信息获取所述逻辑设备的业务配置文件。
PCT/CN2018/102196 2017-08-24 2018-08-24 下发业务配置文件 WO2019037775A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP18848673.2A EP3675418B1 (en) 2017-08-24 2018-08-24 Issuance of service configuration file

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710734609.5 2017-08-24
CN201710734609.5A CN108632074B (zh) 2017-08-24 2017-08-24 一种业务配置文件下发方法和装置

Publications (1)

Publication Number Publication Date
WO2019037775A1 true WO2019037775A1 (zh) 2019-02-28

Family

ID=63705742

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/102196 WO2019037775A1 (zh) 2017-08-24 2018-08-24 下发业务配置文件

Country Status (3)

Country Link
EP (1) EP3675418B1 (zh)
CN (1) CN108632074B (zh)
WO (1) WO2019037775A1 (zh)

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110175020A (zh) * 2019-04-10 2019-08-27 阿里巴巴集团控股有限公司 框架属性信息扩展方法和装置、框架加载方法和装置
CN110221904A (zh) * 2019-06-17 2019-09-10 腾讯科技（深圳）有限公司 一种业务流程控制方法
CN111639119A (zh) * 2020-06-03 2020-09-08 上海盛付通电子支付服务有限公司 反洗钱系统中的客户信息查询方法和设备
CN112204520A (zh) * 2019-07-11 2021-01-08 深圳市大疆创新科技有限公司 配置方法、物理设备、服务器及计算机可读存储介质
CN112394962A (zh) * 2020-11-27 2021-02-23 中国银联股份有限公司 一种业务执行方法、业务逻辑更新方法及装置
CN113098439A (zh) * 2021-03-22 2021-07-09 Oppo广东移动通信有限公司 衰减器的控制方法和设备、芯片及存储介质
CN113794583A (zh) * 2021-08-15 2021-12-14 新华三信息安全技术有限公司 配置方法及装置
CN114257504A (zh) * 2021-12-15 2022-03-29 烽火通信科技股份有限公司 业务场景切换方法及系统
CN114327709A (zh) * 2021-12-20 2022-04-12 深圳Tcl新技术有限公司 一种控制页面生成方法、装置、智能设备及存储介质
CN114679483A (zh) * 2022-03-01 2022-06-28 南京巨鲨显示科技有限公司 一种分布式服务通信系统通信方法、系统及存储介质
CN114827243A (zh) * 2022-05-18 2022-07-29 上海电气风电集团股份有限公司 配置文件下发方法、工具、电子设备和可读存储介质
CN115001967A (zh) * 2022-05-30 2022-09-02 平安科技（深圳）有限公司 一种数据采集方法、装置、电子设备及存储介质
CN111124705B (zh) * 2019-12-04 2024-03-12 中盈优创资讯科技有限公司 业务请求处理方法及装置

Families Citing this family (50)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11593377B2 (en) 2016-09-26 2023-02-28 Splunk Inc. Assigning processing tasks in a data intake and query system
US11416528B2 (en) 2016-09-26 2022-08-16 Splunk Inc. Query acceleration data store
US11620336B1 (en) 2016-09-26 2023-04-04 Splunk Inc. Managing and storing buckets to a remote shared storage system based on a collective bucket size
US11663227B2 (en) 2016-09-26 2023-05-30 Splunk Inc. Generating a subquery for a distinct data intake and query system
US11321321B2 (en) 2016-09-26 2022-05-03 Splunk Inc. Record expansion and reduction based on a processing task in a data intake and query system
US11550847B1 (en) 2016-09-26 2023-01-10 Splunk Inc. Hashing bucket identifiers to identify search nodes for efficient query execution
US11580107B2 (en) 2016-09-26 2023-02-14 Splunk Inc. Bucket data distribution for exporting data to worker nodes
US10353965B2 (en) 2016-09-26 2019-07-16 Splunk Inc. Data fabric service system architecture
US11461334B2 (en) 2016-09-26 2022-10-04 Splunk Inc. Data conditioning for dataset destination
US11874691B1 (en) 2016-09-26 2024-01-16 Splunk Inc. Managing efficient query execution including mapping of buckets to search nodes
US11442935B2 (en) 2016-09-26 2022-09-13 Splunk Inc. Determining a record generation estimate of a processing task
US11250056B1 (en) 2016-09-26 2022-02-15 Splunk Inc. Updating a location marker of an ingestion buffer based on storing buckets in a shared storage system
US11586627B2 (en) 2016-09-26 2023-02-21 Splunk Inc. Partitioning and reducing records at ingest of a worker node
US11615104B2 (en) 2016-09-26 2023-03-28 Splunk Inc. Subquery generation based on a data ingest estimate of an external data system
US11604795B2 (en) 2016-09-26 2023-03-14 Splunk Inc. Distributing partial results from an external data system between worker nodes
US11567993B1 (en) 2016-09-26 2023-01-31 Splunk Inc. Copying buckets from a remote shared storage system to memory associated with a search node for query execution
US11294941B1 (en) 2016-09-26 2022-04-05 Splunk Inc. Message-based data ingestion to a data intake and query system
US11281706B2 (en) 2016-09-26 2022-03-22 Splunk Inc. Multi-layer partition allocation for query execution
US10956415B2 (en) 2016-09-26 2021-03-23 Splunk Inc. Generating a subquery for an external data system using a configuration file
US11860940B1 (en) 2016-09-26 2024-01-02 Splunk Inc. Identifying buckets for query execution using a catalog of buckets
US11599541B2 (en) 2016-09-26 2023-03-07 Splunk Inc. Determining records generated by a processing task of a query
US20180089324A1 (en) 2016-09-26 2018-03-29 Splunk Inc. Dynamic resource allocation for real-time search
US11562023B1 (en) 2016-09-26 2023-01-24 Splunk Inc. Merging buckets in a data intake and query system
US12013895B2 (en) 2016-09-26 2024-06-18 Splunk Inc. Processing data using containerized nodes in a containerized scalable environment
US11921672B2 (en) 2017-07-31 2024-03-05 Splunk Inc. Query execution at a remote heterogeneous data store of a data fabric service
US12118009B2 (en) 2017-07-31 2024-10-15 Splunk Inc. Supporting query languages through distributed execution of query engines
US12248484B2 (en) 2017-07-31 2025-03-11 Splunk Inc. Reassigning processing tasks to an external storage system
US11989194B2 (en) 2017-07-31 2024-05-21 Splunk Inc. Addressing memory limits for partition tracking among worker nodes
US10896182B2 (en) 2017-09-25 2021-01-19 Splunk Inc. Multi-partitioning determination for combination operations
US11334543B1 (en) 2018-04-30 2022-05-17 Splunk Inc. Scalable bucket merging for a data intake and query system
WO2020220216A1 (en) 2019-04-29 2020-11-05 Splunk Inc. Search time estimate in data intake and query system
US11715051B1 (en) 2019-04-30 2023-08-01 Splunk Inc. Service provider instance recommendations using machine-learned classifications and reconciliation
US11494380B2 (en) 2019-10-18 2022-11-08 Splunk Inc. Management of distributed computing framework components in a data fabric service system
US11922222B1 (en) 2020-01-30 2024-03-05 Splunk Inc. Generating a modified component for a data intake and query system using an isolated execution environment image
CN111405004B (zh) * 2020-03-06 2023-07-18 深圳市信锐网科技术有限公司 一种交换机管理方法及装置、设备、存储介质
CN111767088A (zh) * 2020-06-22 2020-10-13 中国建设银行股份有限公司 业务处理方法、装置及电子设备
CN113973109A (zh) * 2020-07-22 2022-01-25 华为技术有限公司 文件下载方法、设备及系统
CN112115028A (zh) * 2020-09-21 2020-12-22 杭州迪普科技股份有限公司 基于系统日志的管理员消息发送方法、装置及系统
US11704313B1 (en) 2020-10-19 2023-07-18 Splunk Inc. Parallel branch operation using intermediary nodes
CN112231603A (zh) * 2020-11-02 2021-01-15 深圳市欢太科技有限公司 一种文件下载方法、服务器、客户端和存储介质
CN112650964B (zh) * 2020-12-28 2023-02-03 上海掌门科技有限公司 一种业务处理方法、设备及机器可读存储介质
CN113162807B (zh) * 2021-04-27 2022-12-30 银清科技有限公司 云管理服务器与sdn的联动实现方法及装置
US12112177B2 (en) 2021-06-16 2024-10-08 Juniper Networks, Inc. Policy driven zero touch provisioning of network devices
US12072939B1 (en) 2021-07-30 2024-08-27 Splunk Inc. Federated data enrichment objects
CN113660356B (zh) * 2021-08-16 2024-01-23 迈普通信技术股份有限公司 网络访问方法、系统、电子设备及计算机可读存储介质
CN113794640B (zh) * 2021-08-20 2022-11-18 新华三信息安全技术有限公司 一种报文处理方法、装置、设备及机器可读存储介质
CN113722007B (zh) * 2021-08-24 2023-11-03 杭州迪普科技股份有限公司 Vpn分支设备的配置方法、装置及系统
CN114465890B (zh) * 2022-01-28 2024-04-16 锐捷网络股份有限公司 零配置方法、装置、设备及系统
US12093272B1 (en) 2022-04-29 2024-09-17 Splunk Inc. Retrieving data identifiers from queue for search of external data system
US12141137B1 (en) 2022-06-10 2024-11-12 Cisco Technology, Inc. Query translation for an external data system

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103188107A (zh) * 2011-12-31 2013-07-03 北京大唐高鸿数据网络技术有限公司 终端设备自动发现和配置部署的系统及方法
US20170339240A1 (en) * 2016-05-23 2017-11-23 Twilio, Inc. System and method for a multi-channel notification service

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7627656B1 (en) * 2005-05-16 2009-12-01 Cisco Technology, Inc. Providing configuration information to an endpoint
US9178857B2 (en) * 2007-11-19 2015-11-03 Verizon Patent And Licensing Inc. System and method for secure configuration of network attached devices
CN101635645B (zh) * 2009-08-28 2012-01-11 中兴通讯股份有限公司 一种网络拓扑的管理方法及装置
CN102135883B (zh) * 2011-03-14 2014-05-14 山东大学 一种支持SaaS应用生成与部署的方法和装置
CN102447574B (zh) * 2011-08-18 2014-03-12 杭州华三通信技术有限公司 一种实现irf设备零配置的方法及设备
CN103227843B (zh) * 2012-08-31 2016-05-04 杭州华三通信技术有限公司 一种物理链路地址管理方法及装置
US9286047B1 (en) * 2013-02-13 2016-03-15 Cisco Technology, Inc. Deployment and upgrade of network devices in a network environment
CN104618942B (zh) * 2014-12-30 2018-03-13 大唐移动通信设备有限公司 一种基于ptn组网的基站自动启动方法、基站和rnc
US10091055B2 (en) * 2015-02-13 2018-10-02 Amazon Technologies, Inc. Configuration service for configuring instances
CN106230616B (zh) * 2016-07-18 2019-09-17 新华三技术有限公司 一种业务配置信息处理方法和系统

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103188107A (zh) * 2011-12-31 2013-07-03 北京大唐高鸿数据网络技术有限公司 终端设备自动发现和配置部署的系统及方法
US20170339240A1 (en) * 2016-05-23 2017-11-23 Twilio, Inc. System and method for a multi-channel notification service

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3675418A4

Cited By (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110175020A (zh) * 2019-04-10 2019-08-27 阿里巴巴集团控股有限公司 框架属性信息扩展方法和装置、框架加载方法和装置
CN110175020B (zh) * 2019-04-10 2023-08-22 创新先进技术有限公司 框架属性信息扩展方法和装置、框架加载方法和装置
CN110221904A (zh) * 2019-06-17 2019-09-10 腾讯科技（深圳）有限公司 一种业务流程控制方法
CN110221904B (zh) * 2019-06-17 2023-08-04 腾讯科技（深圳）有限公司 一种业务流程控制方法
CN112204520A (zh) * 2019-07-11 2021-01-08 深圳市大疆创新科技有限公司 配置方法、物理设备、服务器及计算机可读存储介质
CN111124705B (zh) * 2019-12-04 2024-03-12 中盈优创资讯科技有限公司 业务请求处理方法及装置
CN111639119B (zh) * 2020-06-03 2023-05-26 上海盛付通电子支付服务有限公司 反洗钱系统中的客户信息查询方法和设备
CN111639119A (zh) * 2020-06-03 2020-09-08 上海盛付通电子支付服务有限公司 反洗钱系统中的客户信息查询方法和设备
CN112394962A (zh) * 2020-11-27 2021-02-23 中国银联股份有限公司 一种业务执行方法、业务逻辑更新方法及装置
CN112394962B (zh) * 2020-11-27 2024-01-26 中国银联股份有限公司 一种业务执行方法、业务逻辑更新方法及装置
CN113098439A (zh) * 2021-03-22 2021-07-09 Oppo广东移动通信有限公司 衰减器的控制方法和设备、芯片及存储介质
CN113098439B (zh) * 2021-03-22 2024-02-02 Oppo广东移动通信有限公司 衰减器的控制方法和设备、芯片及存储介质
CN113794583B (zh) * 2021-08-15 2023-12-29 新华三信息安全技术有限公司 配置方法及装置
CN113794583A (zh) * 2021-08-15 2021-12-14 新华三信息安全技术有限公司 配置方法及装置
CN114257504B (zh) * 2021-12-15 2023-05-23 烽火通信科技股份有限公司 业务场景切换方法及系统
CN114257504A (zh) * 2021-12-15 2022-03-29 烽火通信科技股份有限公司 业务场景切换方法及系统
CN114327709A (zh) * 2021-12-20 2022-04-12 深圳Tcl新技术有限公司 一种控制页面生成方法、装置、智能设备及存储介质
CN114679483B (zh) * 2022-03-01 2023-07-25 南京巨鲨显示科技有限公司 一种分布式服务通信系统通信方法、系统及存储介质
CN114679483A (zh) * 2022-03-01 2022-06-28 南京巨鲨显示科技有限公司 一种分布式服务通信系统通信方法、系统及存储介质
CN114827243A (zh) * 2022-05-18 2022-07-29 上海电气风电集团股份有限公司 配置文件下发方法、工具、电子设备和可读存储介质
CN114827243B (zh) * 2022-05-18 2024-03-22 上海电气风电集团股份有限公司 配置文件下发方法、工具、电子设备和可读存储介质
CN115001967A (zh) * 2022-05-30 2022-09-02 平安科技（深圳）有限公司 一种数据采集方法、装置、电子设备及存储介质
CN115001967B (zh) * 2022-05-30 2023-08-29 平安科技（深圳）有限公司 一种数据采集方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
EP3675418A4 (en) 2020-09-02
EP3675418B1 (en) 2023-07-19
CN108632074A (zh) 2018-10-09
CN108632074B (zh) 2020-10-02
EP3675418A1 (en) 2020-07-01

Similar Documents

Publication Publication Date Title
WO2019037775A1 (zh) 下发业务配置文件
WO2021175152A1 (zh) 容器集群系统、容器控制台和服务器
CN109688235B (zh) 虚拟网络业务处理方法、装置和系统，控制器，存储介质
US8650326B2 (en) Smart client routing
US9571455B2 (en) Remote credential management for hybrid clouds with enterprise networks
US8856909B1 (en) IF-MAP provisioning of resources and services
US11438242B2 (en) Method for providing PaaS service, management system, and cloud computing service architecture
US20120084545A1 (en) Methods and systems for implementing a secure boot device using cryptographically secure communications across unsecured networks
CN107636603A (zh) 基于位置的装置可用性
US20190207784A1 (en) Establishing a secure connection between separated networks
US11133933B1 (en) Rapid secure authentication and communications through multitenant components in provider networks
US11425125B2 (en) Shared resource identification
CN105991624B (zh) 一种服务器的安全管理方法及装置
US20190028559A1 (en) Tcp fast open hardware support in proxy devices
US11165761B2 (en) Methods, devices, and computer program products for service security protection
JP7623490B2 (ja) パーベイシブ・リソース識別
US9794261B2 (en) Method and apparatus for controlling access to a server
CN113169999A (zh) 基于位置与用户装置安全地共享文件
US10530658B2 (en) Discovery of system with unique passwords by management console
CN116134795A (zh) 虚拟机置备和目录服务管理
CN102143165B (zh) 对终端进行认证的方法、网络交换机及网络系统
CN109739615B (zh) 一种虚拟硬盘的映射方法、设备和云计算平台
US20160248596A1 (en) Reflecting mdns packets
CN113407983A (zh) 一种安全策略的下发方法及装置
CN110392033A (zh) 一种密码管理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18848673

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018848673

Country of ref document: EP

Effective date: 20200324