Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It will be understood that the terms "comprises" and/or "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
It is also to be understood that the terminology used in the description of the invention herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in the specification of the present invention and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
It should be further understood that the term "and/or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.
Referring to fig. 1, fig. 1 is a flowchart illustrating a method for intelligently managing heterogeneous brand network devices according to an embodiment of the present invention.
As shown in fig. 1, the method includes steps S101 to S106.
S101, device information, user information and instruction information of the target network device are selected and assembled into a simplified instruction.
In this embodiment, selecting the device information of the target network device can screen out the target network device to be operated; selecting the user information of the target network equipment can confirm the role of the logged-in user and whether the logged-in user has the authority to operate the target network equipment, and selecting the instruction information of the target network equipment can acquire specific task details; and after the equipment information, the user information and the instruction information are selected and confirmed, the task can be issued to the target network equipment.
In an embodiment, the selecting the device information of the target network device includes: and selecting brand information, board card information and port information of the target network equipment. The device information of different target network devices is different, and different target network devices can be distinguished through brand information, board card information and port information in the device information, so that the target network devices needing to be operated can be quickly and accurately found; of course, other information that facilitates distinguishing between different target network devices may be included in the device information.
The user information of the selected target network device comprises: and selecting the role of the user from the user role database, and verifying the authority of the user for operating the target network equipment according to the role to obtain a verification result.
The user can only select the target network equipment belonging to the department or the lower department, and the user must have the operation authority; after the user selects the target network device, it is necessary to confirm whether the user has the operation right to continue the subsequent operation, which is performed to improve the security of the target network device.
Specifically, the target network device may be associated with a department to which the target network device belongs in advance, and the backup authority for operating the target network device may be associated with a user of the department to which the target network device belongs; therefore, after the device information of the target network device is obtained, the department to which the target network device belongs can be determined, and after the role of the user is obtained, the department to which the user belongs can be determined according to the role of the user, so that the department to which the user belongs is matched with the department to which the target network device belongs, and if the user succeeds, the user has the operation authority.
Furthermore, the target network device can be associated with an upper department of the department to which the target network device belongs, and the standby authority of the operation target network is associated with an upper department user of the department to which the target network device belongs. In this way, the user has not only the authority to operate the target network device of the department to which the user belongs but also the authority to operate the target network device of the subordinate department of the department to which the user belongs.
The instruction information for selecting the target network device includes: an instruction alias, instruction parameters, and task time of the target network device are selected.
The target network device is configured with a plurality of instructions, which respectively represent a plurality of different tasks, names the whole transaction by setting a command alias, selects a specific instruction parameter, and then selects a time for starting the task.
And then, assembling the device information, the user information and the instruction information into a simplified instruction, wherein the assembling mode can be that the simplified instruction is assembled according to a preset template so as to be convenient for analyzing and reconstructing the simplified instruction subsequently.
And S102, performing command reconstruction on the simplified instruction to obtain task data executable by the target network equipment.
In this embodiment, after the device information, the user information, and the instruction information selected by the user are assembled into the simplified instruction, the target network device may not directly execute the simplified instruction, and command reconstruction is required, that is, the simplified instruction is analyzed and reconstructed to form task data, such as an actual command set, that can be executed on the target network device.
S103, pushing the task data to a task platform end for queue arrangement.
In this embodiment, the task platform end may receive task data and perform queue arrangement; specifically, when a plurality of task data are concurrently pushed to the task platform end, the task platform end can schedule the task data by querying the task time of the task data, that is, the task data with the task time before is scheduled, and the task data with the task time after is scheduled.
More specifically, if a plurality of task data with the same task time are received, whether the task data have a tag which is prioritized under the same task time can be inquired, if so, the task data with the tag which is prioritized is scheduled in front, and the task data without the tag which is prioritized is scheduled in the back.
More specifically, if a plurality of task data with the same task time are received and the tags with the priority arrangement or the tags with the priority arrangement are not preset, the task data can be arranged according to the receiving sequence of the task platform, the task data with the receiving time before is arranged before, and the task data with the receiving time after is arranged after.
And S104, the task platform end calls an execution interface to transmit the input parameters of the task data to a front execution end.
In this embodiment, the task platform terminal calls the execution interface, reads the input parameters of the task data, and sends the input parameters to the pre-execution terminal, and the pre-execution terminal controls the corresponding target network device to complete the task according to the input parameters.
In one embodiment, as shown in fig. 2, step S104 includes:
s201, the task platform end sends the task data to a kafka message queue;
s202, calling the execution interface and transmitting the input parameters in the task data.
In this embodiment, after the task data is sent to the kafka message queue, the process corresponding to the kafka message queue calls the execution interface, and transmits a specific input parameter in the task data.
S105, the preposed execution end controls the target network equipment to execute corresponding operation according to the input parameters;
in this embodiment, the pre-execution end may obtain a target network device that needs to be controlled according to the input device IP, and run the input script on the target network device.
In one embodiment, as shown in fig. 3, step S105 includes:
s301, reading equipment IP and scripts by the execution interface;
s302, logging in target network equipment of the corresponding equipment IP through a network protocol SSH, establishing SSH network connection, and then executing the script and interacting with the target network equipment.
In this embodiment, the execution interface reads and obtains a specific device IP address and a specific script from the input parameters, logs in the device IP address through a network protocol SSH, and then establishes an SSH network connection, that is, the target network device can be operated to execute the script.
And S106, collecting the execution result, then sorting and warehousing, extracting and beautifying through a redisplay interface, and finally displaying.
In this embodiment, after the pre-execution end controls the target network device to execute the script, the system captures data of an execution result, analyzes and sorts the data, and executes a log library to store the data; meanwhile, the echoing interface can extract the analyzed and sorted data and display the data in a display area for a user to check an execution result; specifically, the analyzed and sorted data contains more data codes and characters, which is inconvenient for a user to directly obtain an execution result, the playback interface can further optimize and extract the data when extracting the data, for example, extracting important key data in the data, obtaining the execution result from the key data, and beautifying the execution result, for example, further analyzing and sorting the key data, and directly displaying the key data in a display area through characters or a simple prompt, so that the user can directly view the execution result.
In one embodiment, as shown in fig. 4, step S106 includes:
s401, collecting an execution result after executing the script;
s402, judging whether the execution result is successful;
and S403, encapsulating the execution result and the playback command into a data packet and sending the data packet to a playback interface.
In this embodiment, after the pre-execution end controls the target network device to execute the script and obtain the execution result, it is further required to determine whether the execution result is successful;
if the task is successfully executed, the execution result and the playback command are packaged into a data packet and sent to a playback interface, and the playback interface can display the data packet according to the playback command after receiving the data packet so as to prompt that the task is successfully executed;
if the data package fails, the execution result and the playback command are packaged into the data package and sent to the playback interface, the playback interface can display the data package according to the playback command after receiving the data package so as to prompt that the task is failed to be executed, and a user can check the failure reason from the data package.
For example, a layperson IT needs to perform a port security admission dot1x operation on the devices A, B, C of three manufacturers, each device needs to configure 10 commands, and the layperson needs to master 30 different commands of three manufacturers to complete the work, which is normally impossible. However, with the method provided by the embodiment of the present invention, as long as professional network personnel package 30 commands into the command template A, B, C in advance, and name the whole transaction by the command alias D, and non-professional IT personnel only need to select the command alias and the device to be operated when using the method, the method provided by the embodiment of the present invention directly calls the command template to log in the device to execute the operation by associating the device with the command template, and the non-network professional personnel completes the transaction of starting the port security admission dot1x without knowing any vendor command, thereby achieving the extremely simple effect of de-isomerisation.
According to the embodiment of the invention, the configuration of the related instruction templates can be customized according to the brand and model classification, the simplification of operation and maintenance operation is formed through the customized instruction templates, the instruction difference of different brands and models is shielded, and the work requirement of daily network management and batch operation is met.
By the method provided by the embodiment of the invention, the following effects are realized: the centralized management (batch operation, configuration modification, configuration baseline inspection and the like) of various mainstream brand and model network devices is supported; the device has the capability of automatically learning the device attribute, and the learned content can be customized by a user; the operation instruction realizes extremely simple standardized packaging, and shields equipment difference and manual operation difference; a unified entrance, user and equipment multi-level authority management; the instruction set is in a templated design, has high compatibility and user-defined capability, and allows sharing; shielding static passwords, and carrying out centralized management by a server; the operation behaviors are all logged, so that background audit is facilitated; the multi-process design supports the concurrent efficient operation of multiple devices; the high availability and the framework design of front and back single separation ensure the stability and continuity of the system operation. The embodiment of the invention can be suitable for the scenes of operation and maintenance of a building office network (including terminal security control and network visualization operation and maintenance), operation and security control quick response of a national enterprise and a central enterprise protective network mobile network, and real-time control requirements of enterprises on PC terminal assets.
Referring to fig. 5, fig. 5 is a schematic block diagram of a system for intelligently managing heterogeneous branded network devices according to an embodiment of the present invention.
The embodiment of the invention provides a system for intelligently managing heterogeneous brand network equipment, which comprises: a main system 51, a task platform end 52 and a pre-execution end 53;
the host system 51 is configured to select device information, user information, and instruction information of the target network device 54;
the main system 51 is further configured to perform command reconstruction on the device information, the user information, and the instruction information, obtain task data that can be executed by the target network device 54, and push the task data to a task platform end;
the task platform end 52 is configured to queue and arrange task data, and call an execution interface to transmit input parameters of the task data to a pre-execution end 53;
the pre-execution end 53 is configured to control the target network device 54 to execute a corresponding operation according to the input parameter;
the front execution end 53 is also used for collecting execution results, then sorting and warehousing, extracting and beautifying through a playback interface, and finally displaying.
In this embodiment, the user selects the device information, the user information, and the instruction information of the target network device 54 through the host system 51, and assembles them into a simplified instruction; the main system 51 performs command reconstruction on the simplified instruction to obtain task data executable by the target network device 54, and then sends the task data to the task platform 52.
The task platform end 52 receives the task data, performs queue arrangement according to task time and a preset tag with priority arrangement, and then calls an execution interface to transmit input parameters of the task data to the pre-execution end 53.
The pre-execution end 53 receives the input parameters, reads and obtains a specific device IP address and a specific script, that is, connects to the target network device 54 corresponding to the device IP address, executes the script, collects the execution results after the execution is completed, sorts and stores the execution results in a warehouse, extracts and beautifies the execution results through a display interface, and displays the execution results for the user to directly view the execution results.
In an embodiment, the host system 51 is configured to select brand information, board information, and port information of the target network device 54;
the host system 51 is further configured to select a role of the user from the user role database, and verify the authority of the user to operate the target network device 54 according to the role to obtain a verification result;
the host system 51 is also used to select an instruction alias, instruction parameters, and task time for the target network device 54.
In this embodiment, the brand information, the board information, and the port information corresponding to the target network device 54 may be input in advance and stored in the main system 51, and the user may select the target network device 54 to be operated by directly selecting the brand information, the board information, and the port information;
the user role may be input in advance and stored in the host system 51, and the user directly selects the user role and verifies whether the selected user role has the authority to operate the target network device 54, if so, the operation is continued, and if not, the authority is reselected or may be newly added.
In one embodiment, the task platform end 52 is configured to send the task data to a kafka message queue;
the task platform end 52 is also used to invoke the execution interface and to transfer the input parameters in the task data.
In this embodiment, the task platform end 52 receives task data sent by the host system 51, and sends the task data to a kafka message queue, and the kafka message queue performs queue organization by analyzing task time of the obtained task data and whether a priority organization tag exists;
after the task data are queued and arranged, the process corresponding to the kafka message queue calls the execution interface and transmits specific input parameters in the task data.
In one embodiment, the pre-execution end 53 is used for the execution interface to read device IP and scripts;
the pre-execution end 53 is further configured to log in a target network device 54 of the corresponding device IP through a network protocol SSH, establish an SSH network connection, and then execute the script and interact with the target network device 54.
In this embodiment, the execution interface reads and obtains the specific device IP address and the specific script from the input parameters, logs in the device IP address through the SSH, and then establishes the SSH network connection, so that the target network device 54 can be operated to execute the script.
In an embodiment, the pre-execution end 53 is configured to collect an execution result after executing a script;
the pre-execution end 53 is further configured to determine whether an execution result is successful;
the pre-execution end 53 is further configured to encapsulate the execution result and the playback command into a data packet, and send the data packet to the playback interface.
In this embodiment, after the pre-execution end 53 completes the execution of the script, the pre-execution end continues to collect the execution result and determine whether the execution result is successful, then encapsulates the execution result and the playback command into a data packet, sends the data packet to the playback interface, and displays whether the execution result is successful.
While the invention has been described with reference to specific embodiments, the invention is not limited thereto, and various equivalent modifications and substitutions can be easily made by those skilled in the art within the technical scope of the invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.