公开(公告)号：US20170054757A1

公开(公告)日：2017-02-23

申请号：US14976338

申请日：2015-12-21

Applicant: Cisco Technology, Inc.

Inventor： Zachary D. Siswick ,  Umesh Kumar Miglani ,  Daniel Hollingshead ,  Karyll Catubig ,  Yedidya Dotan ,  Denis Knjazihhin

IPC: H04L29/06 ,  G06F3/0484 ,  G06F3/0481

CPC classification number: H04L63/20 ,  G06F3/04817 ,  G06F3/04842 ,  H04L63/02 ,  H04L63/102

Abstract: In a computer implemented method, selectable device icons that represent respective network security devices are generated for display. Responsive to a selection of one of the device icons, selectable interface icons that represent respective network interfaces used by the network security device represented by the selected device icon are generated for display. Responsive to a selection of one of the interface icons, selectable policy icons that represent respective security polices applied to the network interface represented by the selected interface icon are generated for display. Responsive to a selection of one of the policy icons, selectable object group icons that represent respective groups of security rule objects used in the network security policy represented by the selected policy icon are generated for display.

Abstract translation: 在计算机实现的方法中，生成表示相应的网络安全设备的可选设备图标用于显示。 响应于选择一个设备图标，生成表示由所选择的设备图标表示的网络安全设备使用的各个网络接口的可选接口图标以供显示。 响应于选择一个接口图标，生成表示应用于由所选接口图标表示的网络接口的相应安全策略的可选择策略图标以进行显示。 响应于选择一个策略图标，生成表示由所选择的策略图标表示的网络安全策略中使用的各组安全规则对象的可选择对象组图标以进行显示。

公开(公告)号：US10182055B2

公开(公告)日：2019-01-15

申请号：US15426702

申请日：2017-02-07

Applicant: Cisco Technology, Inc.

Inventor： Joe Lawrence ,  Jason M. Perry ,  Yedidya Dotan ,  Denis Knjazihhin ,  Umesh Kumar Miglani

IPC: G06F17/00 ,  H04L29/06

Abstract: A management entity communicates over a network with devices on which security rules are configured to control network access. Data that indicates a hit count for each security rule across the devices is repeatedly collected from the devices. The indicated hit counts for each security rule are aggregated over different repeating time intervals to produce repeatedly aggregated hit counts for respective ones of the different repeating time intervals. The security rules are generated for display on a user interface screen as selectable options. Responsive to a selection of one of the security rules, a selected security rule and most recently aggregated hit counts for the different repeating time intervals for the selected security rule are generated for concurrent display on the user interface screen. The display of the most recently aggregated hit counts for the selected security rule is updated as time progresses.

公开(公告)号：US09992232B2

公开(公告)日：2018-06-05

申请号：US15131604

申请日：2016-04-18

Applicant: Cisco Technology, Inc.

Inventor： Daniel Hollingshead ,  Sachin Vasant ,  Yedidya Dotan ,  Umesh Kumar Miglani ,  Denis Knjazihhin

IPC: H04L29/06 ,  H04L12/24

CPC classification number: H04L63/20 ,  H04L41/0893 ,  H04L63/0263

Abstract: Presented herein are techniques for creating a policy block comprised of a group of lines of rules/statements across configuration files for network devices. An algorithm is provided that determines when multiple policies are to be merged together into one policy. In one embodiment, data is uploaded from a network that includes a plurality of network devices. The data represents policy rules configured on the plurality of network devices. The data representing the policy rules is compared for similarities in order to group together policy rules based on their similarities. Data is stored representing a plurality of clusters, each cluster representing a group of policy rules that have been grouped together. One or more configuration policies are generated to be applied across the plurality of network devices using the data representing each of the plurality of clusters, while maintaining context of policy rule processing.

公开(公告)号：US09948679B2

公开(公告)日：2018-04-17

申请号：US14976338

申请日：2015-12-21

Applicant: Cisco Technology, Inc.

Inventor： Zachary D Siswick ,  Umesh Kumar Miglani ,  Daniel Hollingshead ,  Karyll Catubig ,  Yedidya Dotan ,  Denis Knjazihhin

IPC: H04L29/06 ,  G06F3/0481 ,  G06F3/0484

CPC classification number: H04L63/20 ,  G06F3/04817 ,  G06F3/04842 ,  H04L63/02 ,  H04L63/102

Abstract: In a computer implemented method, selectable device icons that represent respective network security devices are generated for display. Responsive to a selection of one of the device icons, selectable interface icons that represent respective network interfaces used by the network security device represented by the selected device icon are generated for display. Responsive to a selection of one of the interface icons, selectable policy icons that represent respective security polices applied to the network interface represented by the selected interface icon are generated for display. Responsive to a selection of one of the policy icons, selectable object group icons that represent respective groups of security rule objects used in the network security policy represented by the selected policy icon are generated for display.

公开(公告)号：US20170155562A1

公开(公告)日：2017-06-01

申请号：US15237142

申请日：2016-08-15

Applicant: Cisco Technology, Inc.

Inventor： Sachin Vasant ,  Umesh Kumar Miglani ,  Zachary D. Siswick ,  Doron Levari ,  Yedidya Dotan

IPC: H04L12/26 ,  H04L29/12

CPC classification number: H04L63/0227 ,  H04L63/1408 ,  H04L63/20

Abstract: A network management entity is configured to communicate with one or more network security devices. Each network security device is configured to store in a respective event queue an event for each attempt to access a network accessible destination through the security device. Each event indicates the destination of the attempted access. The management entity periodically collects from the event queues the stored events so that less that all of the events stored in the event queues over a given time period are collected. The management entity determines, based on the collected events, top destinations as the destinations that occur most frequently in the collected events. The management entity determines, based on the collected events, bottom destinations as the destinations that occur least frequently in the collected events. The management entity generates for display indications of the top destinations and generates for display indications of the bottom destinations.

公开(公告)号：US20170353459A1

公开(公告)日：2017-12-07

申请号：US15426702

申请日：2017-02-07

Applicant: Cisco Technology, Inc.

Inventor： Joe Lawrence ,  Jason M. Perry ,  Yedidya Dotan ,  Denis Knjazihhin ,  Umesh Kumar Miglani

IPC: H04L29/06

CPC classification number: H04L63/10 ,  H04L63/0263 ,  H04L63/20

Abstract: A management entity communicates over a network with devices on which security rules are configured to control network access. Data that indicates a hit count for each security rule across the devices is repeatedly collected from the devices. The indicated hit counts for each security rule are aggregated over different repeating time intervals to produce repeatedly aggregated hit counts for respective ones of the different repeating time intervals. The security rules are generated for display on a user interface screen as selectable options. Responsive to a selection of one of the security rules, a selected security rule and most recently aggregated hit counts for the different repeating time intervals for the selected security rule are generated for concurrent display on the user interface screen. The display of the most recently aggregated hit counts for the selected security rule is updated as time progresses.

公开(公告)号：US20170208094A1

公开(公告)日：2017-07-20

申请号：US15131604

申请日：2016-04-18

Applicant: Cisco Technology, Inc.

Inventor： Daniel Hollingshead ,  Sachin Vasant ,  Yedidya Dotan ,  Umesh Kumar Miglani ,  Denis Knjazihhin

IPC: H04L29/06 ,  H04L12/24

CPC classification number: H04L63/20 ,  H04L41/0893 ,  H04L63/0263

Abstract: Presented herein are techniques for creating a policy block comprised of a group of lines of rules/statements across configuration files for network devices. An algorithm is provided that determines when multiple policies are to be merged together into one policy. In one embodiment, data is uploaded from a network that includes a plurality of network devices. The data represents policy rules configured on the plurality of network devices. The data representing the policy rules is compared for similarities in order to group together policy rules based on their similarities. Data is stored representing a plurality of clusters, each cluster representing a group of policy rules that have been grouped together. One or more configuration policies are generated to be applied across the plurality of network devices using the data representing each of the plurality of clusters, while maintaining context of policy rule processing.